Scope authorizations within the current organization

[sauloperez]

What?

In /admin/direct_verifications/authorizations we are currently listing all authorizations regardless of the organization their user belongs to. Needless to say, this is concerning because we're leaking details from all organizations.

We should only list authorizations related to the current organization.

Proposed solution

We should change the existing data fetching

decidim-verifications-direct_verifications/app/controllers/decidim/direct_verifications/verification/admin/authorizations_controller.rb

Lines 24 to 26 in a971f8b

	def collection
	Decidim::Authorization.where(name: "direct_verifications").includes(:user)
	end

to fetch only authorizations whose user belongs to the current_organization. That is, join authorizations with decidim_users where decidim_users.decidim_organization_id = current_organization.id.