Hotfix/4 17304 view time entries permission not respected on wp spent hours

[``* `#17304` View time entries permission not respected for work package's spent hours attribute``](https://community.openproject.org/work_packages/17304)
I am aware that this code here is just moved, but shouldn't it limit ```self_and_descendants``` down to those the user is allowed to see?

Because of cross project issue relations, the check in spent_hours will not suffice here.