feat(issues): Add optional project scoping to qualified short id lookups

[oioki]

Stacked on #117046 — review/merge that first. The diff below is incremental on top of it.

Adds an optional project_ids argument to Group.objects.by_qualified_short_id / by_qualified_short_id_bulk and to the get_by_short_id helper. When provided, the lookup is additionally scoped to those projects at the query layer, so a short id referencing a project the caller cannot access does not resolve.

A qualified short id (e.g. PROJECT-123) embeds a project slug, so resolution always returned the correct group in the correct project — but it was only scoped by organization and never verified that the caller may access that project. Callers that hold an authorized-project set (the projects the actor is allowed to see) can now enforce project-level permissions in the query itself rather than via a post-hoc group.project_id in project_ids check.

project_ids defaults to None (no restriction), so this change is non-breaking and changes no behavior on its own — callers are migrated in follow-up PRs. An empty collection is intentionally distinct from None: it restricts to no projects (nothing resolves), whereas None means "operate organization-wide."

This is the API-core step of a stacked series hardening short-id → group resolution against in-org IDOR; subsequent PRs thread project_ids through the issue endpoints/helpers, search issue: resolvers, and Seer tools, and finally make the argument required.

[cvxluo]

would this approach require every caller to pass in allowed projects? maybe this would be more obvious in a followup PR, but it seems like there would be a lot of duplication and room for error — are we able to e.g. pass in the actor and resolve allowed projects that way?

[oioki]

Thanks @cvxluo

Agreed it gets clearer in the adoption PRs — and the key is that resolution stays centralized where it already lives (get_projects() for endpoints, SnubaParams.project_ids for search), so callers just reuse a value they already have rather than duplicating logic.

An example of adoption PR: #117299

To kill the "room for error", the final PR makes project_ids required keyword-only, so forgetting it is a TypeError + mypy error, and org-wide callers must write an explicit project_ids=None. I went with a scope param over an actor because the right scope differs per caller (search = the query's selected projects, project endpoint = the one URL project, commit-linking/seer = org-wide system) and an actor can't compute superuser-correct access without the request anyway.

End state looks like this:

# model API — required, keyword-only (can't be silently omitted)
def by_qualified_short_id(self, organization_id, short_id, *, project_ids: Collection[int] | None): ...

# endpoint caller — reuses the projects get_projects() already resolved
projects = self.get_projects(request, organization)
group = Group.objects.by_qualified_short_id(org.id, short_id, project_ids=[p.id for p in projects])

# org-wide system caller (commit linking / seer RPC) — explicit + greppable
group = Group.objects.by_qualified_short_id(org_id, short_id, project_ids=None)