Fix/experimental api missing authorizations

https://www.openproject.org/work_packages/15710
The api/v3 unfortunately took up the pattern set by v2 and v1 to strip away the "api/vX" when checking authorization. So those permissions are necessary for the api/v3/queries endpoint.

From todays perspective, I deem it wrong to do something like this as it will make it harder to separate APIs, but changing this now will be to much.