HackerOne Pentesters can access any structured scope object through GraphQL node interface

A missing authorization check in the `StructuredScope` protector class (`app/protectors/protected_structured_scope.rb:42`) enables any HackerOne Pentester to access structured scope objects of programs they aren't invited to or aren't running a penetration test through HackerOne.

class ProtectedStructuredScope
  # ...

  property(:CAN_INVITE_HACKERS) do
    StructuredScope.unscoped
      .joins(:team)
      .merge(Team.that_can_invite_hackers)
  end

  group(
    # ...
    (has_role(H1_PENTESTER) & has_feature(CAN_INVITE_HACKERS)),
  ) do
    allow :id
    allow …