Confusing behavior in `/v3/service_credential_bindings/:guid/details`

Issue

As a non-space developer, non-admin space user, curling /v3/service_credential_bindings returns a list of service credential bindings, but curling /v3/service_credential_bindings/:guid/details for any listed credential binding returns a 404.

Context

It seems like the error case may have been overlooked in the original proposal

Steps to Reproduce

• create a service credential binding
• curl /v3/service_credential_bindings as a non-space developer, non admin user, grab the guid
• curl /v3/service_credential_bindings/:guid/details as a non-space developer, non admin user
• see that you can view the credential in the list but cannot view the credential details

Expected result

I believe the intent is to keep the credentials return from the details endpoint from being viewable by anyone without space developer or admin permissions, however I would expect to get a 403 as the user already knows the binding is present

Current result

Currently the curl returns a 404

Start with the /v3/service_credential_bindings and /v3/service_credential_bindings/:guid/details entry points and reproduce the requests as a non-space developer, non-admin user. Trace the permission and missing-resource handling for a listed binding. Done means the details request returns the expected permission response instead of a 404, with coverage for the reported scenario.