fix(RBAC): correcly apply RBAC to referrers if needed

[jiparis]

Fix filtering by visible referrers in Discover endpoints. Since this endpoint search in multiple orgs, the logic must consider the user role in each of those orgs to apply RBAC on projects if needed.

• if the user doesn't need RBAC in some Organization, the resource is visible
• if the user is "member" in all organizations, RBAC is applied by checking visible projects on each (if the resource is accessible in one of them, it's returned).

Refs #2121

[migmartri]

if the user is "member" in all organizations, RBAC is applied by checking visible projects on each (if the resource is accessible in one of them, it's returned).

I do not follow this logic, could you elaborate?

[migmartri]

I still struggle with this a little bit. I do not understand how you can do a multi-dymension query between orgs that include all the projects, and orgs that include only some.