Scope report views to the requesting user's authorized products

[Maffooch]

Summary

Three closely-related issues in dojo/reports/views.py where the rendered Endpoint/Finding querysets were not scoped at the queryset-construction layer:

1. product_endpoint_report (real cross-product leak) — the legacy non-Location branch built its Endpoint queryset by filtering on finding__active=True etc. without restricting to product=<pid>, so endpoints (and their associated findings) from unrelated products appeared in the rendered report. Added product=product to the Endpoint filter, and extended prefetch_related_endpoints_for_report in dojo/reports/queries.py with an optional product parameter so the prefetched Finding queryset is also scoped (defense in depth, since Endpoint.findings is an M2M and could in principle link cross-product findings). The widget caller keeps the default — its endpoint set already comes from a filter that the caller is responsible for scoping.

2. report_findings — was constructed from Finding.objects.filter() (unscoped). The rendered output was nonetheless scoped because ReportFindingFilter.qs calls get_authorized_findings_for_queryset, but relying on the filter wrapper for authorization is fragile. Moved the authorization to the queryset-construction layer via get_authorized_findings(Permissions.Finding_View) to match the pattern used by ReportBuilder.get_findings.

3. report_endpoints — same pattern as Installation issue #2, swapped to get_authorized_locations(Permissions.Location_View) / get_authorized_endpoints(Permissions.Location_View) so the authorization is visible at the view layer.

Added unittests/test_product_endpoint_report_scoping.py with two products, each with an engagement / test / active finding / endpoint, and a Reader-on-Product-A-only user:

• The legacy product_endpoint_report tests check that the report for Product A only contains Product A's unique marker — and confirmed they fail without the queryset fix.
• The /reports/findings and /reports/endpoints tests act as behavior locks for the new explicit scoping.

Test plan

• `python manage.py test unittests.test_product_endpoint_report_scoping`
• `python manage.py test unittests.test_pdf_report_rendering`
• `python manage.py check`
• `ruff check . --fix`