Fix api leaking notes when user is not authorized to read noteable

fixes #17302

See merge request !4102