get_progress endpoint allows retrieval of arbitrary tasks

Any user, independent whether they are logged in or permitted, can get data about any task using the get_progress endpoint.

Start by tracing the get_progress endpoint and the authorization checks around task lookup. Reproduce access as an unauthenticated or unauthorized user, then inspect the existing endpoint tests if present. Done means users cannot retrieve another task's data without the required permission, with regression coverage for the rejected access.

Written by the indexing model from the issue text.