Add API to get credit cards for a specific user

Currently there is an `accessible_by` on the User and the CreditCard.

A user who has read access to the specified user, currently has access to see their summary credit card info as well.
A user who does not have read access to the specified user, does not have any access their credit card  info.
An admin has access to all.
The `accessible_by` on CreditCard is only there for future roles. It doesn't change the results of the API call right now.