Instance can be accessed with wrong appname in the request URL

## Describe the bug
One can access an instance id or a data id with a wrong/different app name.

## To Reproduce
Steps to reproduce the behavior:
1. Login to AT21 and start an app instance of a deployed app (partydisplaytest)
2. Update the cookies in postman and create a new request of type: GET and wrong app name in the request URL
https://tdd.apps.at21.altinn.cloud/tdd/apptest/instances/50014516/5562e2e9-5a56-40db-8360-d77c681029e2
3. Send the request and the instance details are retrieved with wrong selflinks and dataLinks for the apps parameter

## Expected behavior
One cannot access any instance id or data id when the appname is wrong

## Additional info
app: tdd/partydisplaytest
Env: AT21

Reproduce the GET request from Postman using the wrong app name in the URL, as described for AT21 and app tdd/partydisplaytest. Compare the returned instance details, selflinks, and dataLinks with the expected behavior: a wrong app name must not retrieve the instance or data.

Written by the indexing model from the issue text.