Fix/16705 private queries can be accessed by other user via url

Fixes: https://community.openproject.org/work_packages/16705

Private queries could be accessed by people, who are able to view work packages in a project.