fix(security): harden upstream authorization boundaries

[szymczag]

Summary

• port the applicable upstream authorization and IDOR fixes from makeplane/plane PRs [WEB-8103] fix: stop leaking webhook HMAC secret_key on reads makeplane/plane#9382, [WEB-8110] fix: sanitize page list order_by against an allowlist makeplane/plane#9387, [WEB-8283] fix: bind Spaces board object IDs to the anchor's project makeplane/plane#9442, [WEB-8289] fix: scope draft-to-issue conversion to the draft owner makeplane/plane#9443, [WEB-8291] fix: gate project invitation list/retrieve/destroy to project admins makeplane/plane#9444, [WEB-8332] fix(security): block workspace-member mass-assignment makeplane/plane#9460, [WEB-8333] fix(security): guard undecorated viewset routes with project-membership check makeplane/plane#9461, [WEB-8352] fix(security): scope SubIssuesEndpoint to the URL project makeplane/plane#9466, [WEB-8353] fix(security): enforce guest issue visibility on attachments + activity makeplane/plane#9467, [WEB-8372] fix(security): restrict StateViewSet.partial_update to project admins makeplane/plane#9473, [WEB-8374] fix(security): scope ProjectMemberPreferenceEndpoint to the caller makeplane/plane#9474, [WEB-8382][WEB-8383] fix(security): external-API issue comment + attachment authz makeplane/plane#9475, [WEB-8400] fix(security): scope DeployBoardViewSet queryset to the URL workspace/project makeplane/plane#9481, [SECUR-236] fix: grouped-paginator cursor bound + Project mass-assignment makeplane/plane#9486, and [SECUR-243] fix(security): scope issue comment + relation endpoints to the URL project makeplane/plane#9531
• enforce workspace, project, issue, and object scoping across app, Spaces, deploy-board, and external API endpoints
• prevent mass assignment of membership and project audit fields, scope webhook HMAC secrets, and bound ordering/pagination inputs
• preserve Hangar's stricter upload, SSRF, sub-issue transaction/cycle, workspace-admin, and full-PUT behavior where upstream patches conflicted
• add contract coverage for positive controls and cross-scope denial paths

Why

Several upstream fixes closed authorization gaps where a valid identifier could cross a workspace, project, issue, or ownership boundary. Hangar already had stronger local hardening in overlapping areas, so this ports only the applicable fixes and resolves conflicts in favor of the stricter local behavior.

Validation

• pytest -q: 1168 passed, 6 skipped
• focused upstream security contracts: 111 passed before the Hangar-specific admin regression was added; the final full suite includes all 1174 collected tests
• existing Hangar asset, upload, guest, deploy-board, roster, and ordering regressions: 93 passed
• ruff check plane: passed
• Django system check: no issues
• signed commit verified with GPG key 843C10DB29C13D774EFAEDDB66BD4433741253E0