Integration test to detect unprotected API endpoints

## What?

We should think about adding a test that can detect endpoints
that are unauthenticated or don't require permissions.

## Why?
Prevent security bugs.

## How?
Check all endpoints for missing `@RequiresAuthentication` and `@RequiresPermissions` annotations.
This might produce some false positives, since not all are secured with annotations, but programmatically.