Project resource RPCs do not check that the resource belongs to the request's project #2001

GetProjectResource, UpdateProjectResource and DeleteProjectResource take a resource id and a project id, but never check that the resource belongs to that project.

• UpdateProjectResource loads the project from the request, updates the resource, and writes the app.resource.updated audit log under that project's organization. A caller with update on a resource can send the id of any project, even one they cannot see, and the update goes through with the audit log under that other organization.
• GetProjectResource returns the resource for any project id.
• DeleteProjectResource loads the project from the resource row instead. For an organization resource (feat(api): add CreateOrganizationResource #1987), which has no project, that lookup fails and the call returns an internal error. Nothing is deleted.

Steps

1. User A owns resource R in a project of organization O1.
2. A calls UpdateProjectResource with R's id and the id of a project in organization O2, where A has no access.
3. The update succeeds, and the app.resource.updated audit log is written under O2.

Code
The authorization rules for these RPCs in pkg/server/connect_interceptors/authorization.go check the permission on the resource and the plan on the request's project. The handlers in internal/api/v1beta1connect/resource.go never compare the request's project with the resource's.

Expected
These RPCs refuse a resource that does not belong to the request's project, the way the organization resource RPCs refuse a resource of another organization (#1990).