Verify that API permissions match in-app permissions for all users #2080

Several /api/v1 index endpoints return records without applying the same organization/role scoping enforced in the equivalent Admin UI controllers. For all of these, the access available via the API needs to be reduced to match the access available via the UI. Details here.