Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects

The `Checklist` objects that can be queried through GraphQL are supposed to only be accessible by program members, the users who claimed or responded to a check belonging to a checklist, and HackerOne Pentesters. The `Checklist` object is also supposed to be in the `running` state (e.g. when the …

class ProtectedChecklist
  include ::ProtectedAttribute::Protector

  model { Checklist }

  copy_roles(ProtectedTeam) do
    Checklist.joins(:team)
  end

  property(:RUNNING_CHECKLIST) do
    Checklist.running
  end

  role(:CLAIMER) { |requester| claimed_by_user(requester) }
  role(:RESPONDER) { …