scope poll_sessions closed/opened endpoints to sections

fixes CNVS-13346
This fixes a problem where the poll_session closed and opened endpoints
allow a student to see poll_sessions that do belong to course_sections
they're not enrolled in.

Test plan
- Create a poll
- Create poll sessions with differing course and course sections
- As a student, you should visit the poll_session closed/opened
  endpoints
- You should only see poll sessions for courses AND course sections that
  the student is enrolled in.

Change-Id: I5cfd75dab1dfe0e1ec1c81ac84814bfd2622ef9d
Reviewed-on: https://gerrit.instructure.com/35666
Reviewed-by: Derek DeVries <ddevries@instructure.com>
Tested-by: Bryan Madsen <bryan@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Josh Simpson <jsimpson@instructure.com>