Anyone can cancel any job

Currently, I can go here https://testflinger.canonical.com/jobs and cancel any job.
I'm not saying that people will do it on purpose but it could be accidental, e.g. I want to cancel a job of mine and accidentally copy another job id.

Start at the jobs page and trace the cancellation request to the server-side job cancellation entry point. Confirm how the current request identifies the job and whether ownership is checked. Done means a user can cancel their own job but cannot cancel another user's job, including when a different job ID is supplied.

Written by the indexing model from the issue text.