fix(controlplane): authorize GroupService/ListProjects at the service layer
Closed
MA
3mo ago+10+10+01234567890123456789-1-1-0123456789
Closes PFM-6695
Summary
GroupService/ListProjects was the only group sub-resource handler that resolved results without a service-layer permission check, relying solely on the visibleProjects row filter. That filter returns nil ("RBAC not applied") for legacy RoleViewer users and for org-scoped API tokens, and the data layer treats nil as "no filter" — so those callers received the full group→project attachment map that the design restricts to org admins/maintainers.
This change adds the same PolicyGroupListMemberships guard the sibling handlers already use before resolving projects, matching the earlier ListMembers fix.