fix: add missing source parameter

See merge request !64

Without `source="media"` a POST request to the "episodes" endpoint fails when `mediaId` is set.

This didn't come up far, because Dashboard only uses updates and Django does some magic when setting model attributes on existing instances.

This is helpful for applications like the dashboard that use static
typing and can use the `AnyPermission` type to catch typos and
missing/renamed permission names during the build phase.

This endpoint removes the need setting media eintries through the media
endpoint. This is helpful because a lot of operations that clients will
usually do, like adding new, deleting old, or reordering media sources
becomes non-atomic when operating on lists.

This mixin factory makes it easy to create atomic reorder operations for
entities that have a static numeric order criteria that is supposed to
be updated by clients.