Fix/16705 private queries can be accessed by other user via url

Fixes: https://community.openproject.org/work_packages/16705

Private queries could be accessed by people, who are able to view work packages in a project.
@tessi, one of the benefits of using this pattern is that it is easier to write test. So why are there none?