Activities. Any user can get the resource's activities using the file-id

[prashant-gurung899]

Similar to: #9849

Steps to reproduce

1. create a folder as alice user

2. as alice, create some files and perform some actions (edit/delete) in folder

3. as demo user, check the folder activities using resource(folder) id with cURL request:

   curl 'https://localhost:9200/graph/v1beta1/extensions/org.libregraph/activities?kql=itemid%3A{folder-fileid}' \
   -udemo:demo -vk | jq
   

   {"value": [
     {
      ... # activities
     }
   ]}

Expected behavior

Expected not to get the list of activities when requested by random user.

Actual behavior

Gets the list of all the activities in the folder.

[ScharfViktor]

I prioritized as prio2 because IMHO it's the security hole

[ScharfViktor]

Steps:

• admin shares folder f1 to einstein
• einstein opens folder f1 in the Shares -> copy spaceId from Propfind response body
• put spaceuuid to

curl 'https://localhost:9200/graph/v1beta1/extensions/org.libregraph/activities?kql=itemid%3A{spaceUUId}' \
-ueinstein:relativity -vk | jq

expected: 403 error

Actual: einstein can see all action of the admin personal space 🤯