No children in projects list when using Api-Key

### Current Behavior

- `curl 'http://localhost:8000/api/v1/project?onlyRoot=false' -H 'Authorization: Bearer REDACTED'`
- Include children as `onlyRoot=false` should
- `curl 'http://localhost:8000/api/v1/project?onlyRoot=false' -H 'X-Api-Key: REDACTED'`
- **Only include root projects**

### Steps to Reproduce

1. Create a project with a parent
2. Enable ACL
3. Add parent project to the team
4. Add the team to a user
5. It is listed by the API when using the user's token
5. It is **not** listed by the API when using the team's API token

### Expected Behavior

`onlyRoot=false`should be taken into account when using an API token

### Dependency-Track Version

4.8.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported