Role member suggestion endpoint is reachable for unauthorized users

[nilmerg]

Describe the bug

Any logged in user can, with a specifically crafted request, retrieve role member suggestions. (User- and Usergroup-Names)

To Reproduce

• Generic user X logs in to Icinga2.
  • Captures icingaweb2 login cookies/session cookies
• Retrieves suggestion using the request below

curl -L -X POST <IP>/icingaweb2/role/suggest-role-member?_disableLayout=1&showCompact=1' \
-H 'Origin: <IP>' \
-H 'Accept: */*' \
-H 'Content-Type: application/json' \
-H 'Cookie: Icingaweb2=<TOKEN>; icingaweb2-session=<session_EPOCH> \
--data-raw '{"term":{"label":"*"}}'

Expected behavior

Only users with the correct permission should be able to do this.

Additional context

https://rt.icinga.com/Ticket/Display.html?id=43448