17304 view time entries permission not respected on wp spent hours

[``* `#17304` View time entries permission not respected for work package's spent hours attribute``](https://community.openproject.org/work_packages/17304)
Now that took me a while. 

This:
``` x.self_and_descendants.visible(usr).joins(:time_entries).where(Project.allowed_to_condition(usr, :view_time_entries)).sum(:hours).to_f````

will produce the following DB query:

```SELECT SUM(hours) AS sum_id FROM "work_packages" INNER JOIN "time_entries" ON "time_entries"."work_package_id" = "work_packages"."id" LEFT OUTER JOIN "projects" ON "projects"."id" = "work_packages"."project_id" WHERE "work_packages"."root_id" = 1 AND ("work_packages"."lft" >= 13 AND "work_packages"."lft" < 14) AND (((projects.status=1 AND projects.id IN (SELECT em.project_id FROM enabled_modules em WHERE em.name='work_package_tracking')) AND (projects.is_public = 't' OR projects.id IN (1,9,10,11,12,13,5,8,2) OR projects.id IN (4)))) AND (((projects.status=1 AND projects.id IN (SELECT em.project_id FROM enabled_modules em WHERE em.name='time_tracking')) AND (projects.id IN (1,9,10,11,12,13,5,8,2))))```

Which means that the the visibility regarding ```:view_time_entries``` will not be checked. AR seems to just ignore it. However, if it is changed to


``` TimeEntry.visible(usr).on_work_packages(x.self_and_descendants.visible(usr)).sum(:hours) ```


the DB statement is:


```SELECT SUM("time_entries"."hours") AS sum_id FROM "time_entries" LEFT OUTER JOIN "projects" ON "projects"."id" = "time_entries"."project_id" WHERE "time_entries"."work_package_id" IN (SELECT "work_packages"."id" FROM "work_packages" WHERE "work_packages"."root_id" = 1 AND ("work_packages"."lft" >= 13 AND "work_packages"."lft" < 14) AND (((projects.status=1 AND projects.id IN (SELECT em.project_id FROM enabled_modules em WHERE em.name='work_package_tracking')) AND (projects.is_public = 't' OR projects.id IN (1,9,10,11,12,13,5,8,2) OR projects.id IN (4)))) ORDER BY "work_packages"."lft") AND (((projects.status=1 AND projects.id IN (SELECT em.project_id FROM enabled_modules em WHERE em.name='time_tracking')) AND (projects.id IN (1,9,10,11,12,13,5,8,2))))```

The second looks right.

The whole problem is caused by:
* visibility scope not being applied twice
* the existence of a project_id foreign key on time_entries. This can cause a situation where a time entry and it's associated work package are in different projects.