Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary

The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.

Steps to Reproduce

1. Start Budibase

docker run -d --name budibase-poc -p 10000:80 \
  -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \
  -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \
  -e API_ENCRYPTION_KEY=api_enc_key_test123456 \
  -e BB_ADMIN_USER_EMAIL=admin@test.com \
  -e BB_ADMIN_USER_PASSWORD=TestPassword123! \
  budibase/budibase:latest

until curl -sf http://localhost:10000/health; do sleep 5; done