[feature] Show shared objects for org-wide batch commands as read-only to non-superusers

Is your feature request related to a problem? Please describe.
Org-wide batch commands (organization=null) created by superusers are currently visible to all organization managers/admins via the REST API. However, there is no proper support in openwisp-users for showing shared objects as read-only to non-superusers. This means org admins can see batch commands they didn't create and shouldn't have full access to.

Describe the solution you'd like

1. Implement shared object read-only support in openwisp-users so non-superusers can see objects with organization=null but cannot modify them.
2. Once https://github.com/openwisp/openwisp-users/pull/444 merged, remove the temporary queryset filter in BatchCommandListView and BatchCommandDetailView that excludes organization=null for non-superusers.
3. Ensure org-wide batch commands are visible as read-only to org managers, while keeping create/update/delete restricted to superusers.
4. Hide sensitive data such as primary keys, error logs, and other restricted information from non-superusers for objects not in their managed organizations.

Describe alternatives you've considered
PR https://github.com/openwisp/openwisp-controller/pull/1395 implements the Mass Command model and REST APIs with a temporary queryset filter (with TODO comments) to exclude organization=null commands for non-superusers. This workaround will be removed once openwisp-users properly supports shared objects as read-only.

Additional context

• Related openwisp-users issues and PR:
  https://github.com/openwisp/openwisp-users/issues/238
  https://github.com/openwisp/openwisp-users/issues/448
  https://github.com/openwisp/openwisp-users/pull/444

• Releted openwisp-controller batch command issues and PR:
  https://github.com/openwisp/openwisp-controller/issues/1344
  https://github.com/openwisp/openwisp-controller/issues/1345
  https://github.com/openwisp/openwisp-controller/pull/1395
  https://github.com/openwisp/openwisp-controller/pull/1420

Note: Do not pick this up until the related issues/PR are closed.

Wait for the related openwisp-users work, especially PR #444, before starting. Then inspect BatchCommandListView and BatchCommandDetailView in openwisp-controller, including the temporary queryset filters and TODOs introduced around PR #1395. Done means organization=null batch commands are visible read-only to non-superusers, mutations remain restricted, and sensitive fields are hidden.