VulnerabilityResource might bypass ACLs

[stohrendorf]

Current Behavior

It seems that some endpoints might leak vulnerable software despite ACLs (only looked at the vulnerability endpoint so far). As of right now, this is speculation, and may be closed by DT maintainers at their wish. However, filtering based on ACLs seems to only happen for components most of the time, but not vulnerable software.

Dependency-Track Version

4.12.7

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

The ACL feature is not complete yet so gaps are to be expected, see for example #1127.

We expect it to be complete and fully reliable in v5: DependencyTrack/hyades#1645

Leaving this open though so this gap is documented and we can verify later that it is indeed closed.