Feat: Security audit of supplier API response objects - 950

[hamed-valiollahi]

This PR audits supplier API responses to prevent unauthorized data exposure.

• Scope GET /transfers/ to requesting user's org
• Strip compliance unit balances from GET /organizations/{id} for non-owners
• Add org ownership check to penalty analytics/logs endpoints
• Add org ownership guard to PUT /organization/{org_id}/users/{user_id} for MANAGE_USERS role
• Add org access validation to compliance report changelog endpoint
• Change SummarySchema.extra from allow to ignore

Closes #950

[github-actions]

Frontend Test Results

    1 files    316 suites   3m 31s ⏱️
5 305 tests 5 287 ✅ 18 💤 0 ❌
5 321 runs  5 303 ✅ 18 💤 0 ❌

Results for commit cfbdb04.

♻️ This comment has been updated with latest results.

[github-actions]

Backend Test Results

1 924 tests   1 923 ✅  15m 5s ⏱️
   45 suites      1 💤
    1 files        0 ❌

Results for commit cfbdb04.

♻️ This comment has been updated with latest results.

[AlexZorkin]

lots of great security additions here ty 👍

[hamed-valiollahi]

lots of great security additions here ty 👍

Thanks Alex, appreciate the review.