GDPR-anonymize an Applicant, clearing selected data keys

Anonymizes this applicant's personal data per GDPR right-to-erasure: name, contact details, messages, notes, documents, and the data/structured_data/secure_data keys listed in data_denylist. Other applicants that share its email or phone are not touched. Soft-deleted applicants are anonymized too. When the applicant has a Worker Experience profile, that profile is deleted first. If the deletion fails, the applicant is left unchanged and the request returns 503, so a retry is safe. If Worker Experience is not enabled for the account, the applicant is left unchanged and the request returns 409. If the profile also belongs to another applicant, it is kept, the applicant is anonymized, and the request returns 200 with the reason. Idempotent — a no-op if the applicant has already been anonymized. A scoped API token needs create and delete access to applicants (applicants: cd). Without create access the request returns 401, and without delete access it returns 403.