Restrict access to user field

[maarcingebala]

This PR adds permission checks to all User fields to make sure that we return it only for staff users with proper permissions or for authenticated users fetching their own data.

Pull Request Checklist

1. Privileged views and APIs are guarded by proper permission checks.
2. All visible strings are translated with proper context.
3. All data-formatting is locale-aware (dates, numbers, and so on).
4. Database queries are optimized and the number of queries is constant.
5. Database migration files are up to date.
6. The changes are tested.
7. GraphQL schema and type definitions are up to date.
8. Changes are mentioned in the changelog.

[codecov]

Codecov Report

Merging #5194 into master will decrease coverage by 0.01%.
The diff coverage is 89.65%.

@@            Coverage Diff            @@
##           master   #5194      +/-   ##
=========================================
- Coverage   91.81%   91.8%   -0.02%     
=========================================
  Files         270     270              
  Lines       17503   17540      +37     
  Branches     1516    1523       +7     
=========================================
+ Hits        16071   16102      +31     
- Misses       1037    1040       +3     
- Partials      395     398       +3

Impacted Files	Coverage Δ
saleor/graphql/checkout/types.py	96.26% <100%> (+0.26%)	⬆️
saleor/graphql/checkout/schema.py	100% <100%> (ø)	⬆️
saleor/graphql/giftcard/types.py	100% <100%> (ø)	⬆️
saleor/graphql/account/types.py	95.16% <80%> (-1.31%)	⬇️
saleor/graphql/order/types.py	89.42% <87.5%> (-0.18%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 233b889...8424bfd. Read the comment docs.

[django-queries]

Here is the report for 8424bfd (maarcingebala/saleor @ restrict-user-access)
Base comparison is 233b889.

No differences were found. (click me)

# api.benchmark checkout
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  add billing address to checkout            	         34	         34	             20
  add shipping to checkout                   	          7	          7	              0
  checkout payment charge                    	         10	         10	              0
  complete checkout                          	          8	          8	              0
  create checkout                            	          5	          5	              1

# api.benchmark homepage
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  retrieve main menu                         	          5	          5	              0
  retrieve product list                      	          4	          4	              0
  retrieve secondary menu                    	          5	          5	              0
  retrieve shop                              	          2	          2	              0

# api.benchmark product
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  product details                            	         18	         18	              4
  retrieve product attributes                	          9	          9	              0

# api.benchmark variant
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  product variant bulk create                	         51	         51	              3
  retrieve variant list                      	         23	         23	              9

# api product sorting attributes
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  sort product not having attribute data     	         21	         21	              0

[patrys]

It would be great to have more test cases where access is denied.