This commit introduces a new DB function called `isSharedWith`
that can be used to check for team/public/private nodes and their
shared resources.

This commit partially undo the access policy checks for the
GraphQL endpoints, until we find a better story to correlate
the `user_id` we sometimes receive with the info from the
`AuthenticatedUser`.

It can be used to "bolt-on" policy checking into Servant API routes.