Security Fix breaks API endpoint /rac/endpoints

### Describe the bug

see my comment on the pull request https://github.com/goauthentik/authentik/pull/24066

### How to reproduce

I have configured a service account with the permission for view and change of Endpoints to set the connection password via API. After this change a GET request to `/rac/endpoints/` returns an empty list in the `result`:

```json
{
"pagination": {
"next": 0,
"previous": 0,
"count": 2,
"current": 1,
"total_pages": 1,
"start_index": 1,
"end_index": 2
},
"results": [],
"autocomplete": {}
}
```

On the other hand if I try to access a specific endpoint I get the expected data (via `get /rac/endpoints/{pbm_uuid}/`).

If I use an API token of a superuser for the GET request to `/rac/endpoints/` , the results will contain all endpoint data (as before for my service account).

How can I configure least privileges for such a service user to get at least a list of all endpoints with there pk's? Maybe an additional permission needs to be included for that?

### Expected behavior

The API enpoint should at least return a list of endpoints and there UUIDs

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.5.5

### Relevant log output

```shell

```

Review PR #24066 alongside the /rac/endpoints/ list request and its permission behavior. Reproduce with a service-account token that has view and change Endpoint permissions, then compare the list response with a superuser and the detail endpoint. Done when the least-privilege request returns endpoint UUIDs in results.

Written by the indexing model from the issue text.