Added last4 for v4 api physcial HCB card activations.

[scooterthedev]

Summary of the problem

This method under the v4 api allowed anyone to activate a physical HCB card without the last 4 digits being submitted. #10075

Describe your changes

• Adds a check to mandate and verify the last 4 digits of the physical HCB card before activation. This can be called via a PATCH request to /api/v4/cards/:card_id with the Authorization token being your Bearer and the URL parameters being last4: last 4 digits and status: active. Status: frozen does not require last4.

• Also removed the ability to freeze cancelled cards because the card is frozen FOREVER already ;)

This will affect the HCB mobile app as it will now require the last4 before it can authorize the activation CC: @thedev132

[scooterthedev]

@sampoder quick reminder ;)! I think I fixed your review, but if you could double check, that would also be awesome.