Promiscuous viewer mode requires access to charts in addition to dashboard

### Bug description

First of all, I'm not 100% sure this is a bug or intended purpose so @villebro might be able to answer this quickly as the contributor of this feature. If this is working as per intended design then I'm fine closing this one, but would be happy for it to be considered even if it is working as intended.
If it's working as intended the UI should error on missing chart access instead of being stuck on a loading screen.

https://github.com/apache/superset/pull/38831 implemented the flag `VIEWER_PROMISCUOUS_MODE` which based on the pull request description;

> When enabled with ENABLE_VIEWERS, viewers can access dashboards/charts without explicit datasource permissions, mirroring the previous DASHBOARD_RBAC behavior

When testing this feature and give viewer access to the dashboard I cannot view it without also giving viewer access to relevant charts, it just stays on a loading screen. If a dashboard has 10+ charts it can quickly become tedious regardless of automation.

It would be beneficial if it be more of a top-down approach where if a user/group is given access to a higher-level item (i.e. dashboard) it should also be inherited on relevant charts (and datasets, but that already works).

**AI investigation**

**Root cause**
`SecurityManager.can_drill_dataset_via_dashboard_access(dataset, dashboard)` is the function that implements this bypass, and it's already used correctly in `superset/datasets/api.py` and `superset/views/datasource/views.py`. It was simply never wired into `superset/dashboards/api.py's` `_serialize_dashboard_chart` / `_serialize_dashboard_dataset`, and neither `get_charts()` nor `get_datasets()` even holds a reference to the Dashboard to pass in.

**Suggested fix**
In `get_charts()/get_datasets()`, resolve the dashboard once and pass it into both serializers; have each serializer treat `can_access_chart(chart)` or `can_drill_dataset_via_dashboard_access(chart.datasource, dashboard)` (and the dataset equivalent) as the "can see full data" condition — mirroring the pattern already used in `datasets/api.py/datasource/views.py`.

**Test gaps (none of these exist today):**

Dashboard viewer + VIEWER_PROMISCUOUS_MODE=True → chart list retains form_data.
Same setup → dataset list retains full metadata.
VIEWER_PROMISCUOUS_MODE=False → metadata still narrowed as today.
Viewer with access to only one dashboard dataset can't read unrelated datasets via this endpoint.
Unpublished dashboard → viewer still denied.

### Screenshots/recordings

_No response_

### Superset version

master / latest-dev

### Python version

3.12

### Node version

18 or greater

### Browser

Chrome

### Additional context

_No response_

### Checklist

- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

Start in superset/dashboards/api.py, especially get_charts(), get_datasets(), _serialize_dashboard_chart, and _serialize_dashboard_dataset. Compare the existing dashboard-access logic in superset/datasets/api.py and superset/views/datasource/views.py, including SecurityManager.can_drill_dataset_via_dashboard_access(). Done means permitted dashboard viewers retain chart and dataset metadata under VIEWER_PROMISCUOUS_MODE, while disabled mode, unrelated datasets, and unpublished dashboards remain restricted.

Written by the indexing model from the issue text.