fix: restore authz checks and default-deny filtering in restricted_*_filter

[devin-ai-integration]

Summary

Restores the authorization and query-filtering fixes from Netflix#6155 that were reverted in source only (tests retained), causing 3 test failures.

auth/views.py — GET /users/{user_id} was missing its OrganizationMemberPermission dependency, leaving the endpoint unprotected. Re-added it.

database/service.py — three regressions:

1. restricted_incident_filter / restricted_case_filter only filtered for role == member, leaving admin/owner/manager/none roles unhandled. Restored default-deny approach:

   # admin/owner/manager → unrestricted
   if role in [admin, owner, manager]:
       return query.distinct()
   # all other roles → outerjoin + filter on visibility + participant email

   Also switched join → outerjoin (inner join dropped open-visibility items with no participants) and added the missing Visibility.restricted condition.

2. search_filter_sort_paginate stored the restricted query in query_restricted and applied it via .intersect() only for Incident/Case models, breaking sort ordering for all models. Restored direct query = apply_model_specific_filters(...) application.

3. Removed a stray print() debug statement in apply_filter_specific_joins.

Link to Devin session: https://app.devin.ai/sessions/275b7e9077c04ac4b2648bb9d8969025

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring