CORE: add authorization to getVoById() and getVoByShortName()

- For GROUP_ADMINs, user must be group admin of requested VO.