Fix/16705 private queries can be accessed by other user via url

Fixes: https://community.openproject.org/work_packages/16705

Private queries could be accessed by people, who are able to view work packages in a project.
It's only indirectly tested by the other spec. I'll add specific policy tests.