Should not be able to fetch NR without a matching phone number or email address

Currently the Legal API has an endpoint to fetch a NR's data.

The Edit UI calls this endpoint to get a potential correction NR and then validates that the entered phone number or email address matches the NR. If so then the NR is used for the subject IA correction.

In my opinion, having the UI determine whether the NR is valid is a (small) security issue (with possibly low severity) -- it may be possible for an altered/alternate UI to bypass the validity check and just use any NR they can fetch for an IA correction.

One potential solution is for the API to validate the NR's phone/email when the IA correction is filed... however the phone/email are available right in the NR so this provides no security.

A better solution is for the phone/email to be required to fetch a NR (as is done in auth-web, see [affiliation.py](https://github.com/bcgov/sbc-auth/blob/457ca9cf7aa56a820bd1b271169bc6d6b687f93d/auth-api/src/auth_api/services/affiliation.py#L214)). However this would require rework of all 3 UIs (since they can all fetch a NR).

**This ticket should be discussed among the team to decide if this is a significant issue and whether we should do anything about it.**