fix(seer explorer): Restrict to orgs with open membership

[jasonyuezhang]

Only allows orgs with organization.flags.allow_joinleave set to true to use Seer Explorer. This is because Explorer requires aggregating context across all projects, which violates permissions if some members aren't allowed to access some projects.

---

Copied from getsentry#101178
Original PR: getsentry#101178

[propel-test-bot]

Restrict Seer Explorer Access to Organizations With Open Membership

This pull request enforces that only organizations with organization.flags.allow_joinleave set to true (i.e., open team membership) are permitted to access the Seer Explorer feature. This change is introduced to prevent permission violations that could occur when Seer Explorer aggregates context across projects, as closed team membership could involve restricted access. The implementation updates both the endpoint logic to add the necessary restriction checks and the associated tests to ensure correct permission handling and error messaging.

Key Changes

• Added checks in OrganizationSeerExplorerChatEndpoint (src/sentry/seer/endpoints/organization_seer_explorer_chat.py) to return a 403 response if organization.flags.allow_joinleave is false on both GET and POST methods.
• Updated error messages to clearly state that Seer Explorer requires open team membership.
• Introduced new test cases in tests/sentry/seer/endpoints/test_organization_seer_explorer_chat.py to verify correct 403 responses and messaging when open membership is disabled.

Affected Areas

• src/sentry/seer/endpoints/organization_seer_explorer_chat.py (endpoint logic for Seer Explorer)
• tests/sentry/seer/endpoints/test_organization_seer_explorer_chat.py (endpoint permission tests)

This summary was automatically generated by @propel-code-bot