Review permission checks for both plugin and wpcom APIs

Previously we had several issues regarding permission checks, user token, blog token etc. For example: https://github.com/Automattic/jetpack/pull/24099

We probably want to check all REST API our plugin provided have the right access control or using the right token to authenticate:

https://github.com/Automattic/jetpack/pull/24099

Also we need to check the WPCOM endpoints:

- `sites/{site}/jetpack_search/plan`
- `sites/{site}/jetpack_search/stats`
- etc

More information: p9dueE-55u#comment-7999

The outcome of the task would be whether they are okay, if not we'll need to file issues.

Start by reviewing the linked pull request and the listed WPCOM endpoints: sites/{site}/jetpack_search/plan and sites/{site}/jetpack_search/stats. Check whether the plugin and WPCOM APIs use the appropriate permissions and user or blog tokens. Done means documenting which checks are correct and filing follow-up issues for any gaps.

Written by the indexing model from the issue text.