Graph /users endpoint leaks personal spaces

When getting users via the `graph/users` endpoint (like web does) the server attaches sensitive information (the users personal drive in particular).

#### Steps to reproduce
- create a project space with multiple members, let's say einstein and katherine
- as einstein navigate to the project space, web will `GET` the users via the `graph/v1.0/users/{userid}?$select=&$expand=drive` endpoint. (Alternatively curl it yourself)
- Inspect the result

#### Expected
as einstein I am not allowed to see other users personal spaces. They should not be contained in the result and the user object should only contain minimal information

#### Actual
the drive is attached to the user object, allowing einstein to see katherines quota and last upload time.