Normal user can get expanded members information of a group

## Describe the bug

When an admin user get a group with its member information then it is allowed but when a normal user tries the same thing, the normal user can also get the same information as the admin gets. A bit strange if its a bug or a feature.

## Steps to reproduce

Steps to reproduce the behavior:

1. create user `user1` and `user2`
2. make `user1` an admin
3. create a group called `bug`
4. add both user to group `bug`

### Curl request

1. curl request to get the id of the group called `bug`
```console
curl -XGET -k -u: https://host.docker.internal:9200/graph/v1.0/groups | jq
```
After the above request grab the `` of group `bug`

2. curl request to get all the members information of a group `bug` (expanded)
```console
curl -XGET -k -u: 'https://host.docker.internal:9200/graph/v1.0/groups/?$expand=members' | jq
```

## Expected behavior
When normal user `user2` makes the request using the above curl command

response should be as:
```json
{
"error": {
"code": "accessDenied",
"innererror": {
"date": "2023-02-21T05:59:15Z",
"request-id": "ce62aea3c49a/oZFQo5MGlS-001957"
},
"message": "Unauthorized"
}
}

```

## Actual behavior
When normal user `user2` makes the same request then the response is as:

```json
{
"displayName": "bug",
"id": "53abb729-86fa-45a9-b2e4-a8d9f2872de6",
"members": [
{
"displayName": "user1 gurung",
"id": "8ad4d657-1d3c-4107-83d6-8fe5f8f078b4",
"mail": "user1@gmail.com",
"onPremisesSamAccountName": "user1"
},
{
"displayName": "user3",
"id": "7d06a068-4056-433c-861b-37f742dfa36b",
"mail": "user2@gmail.com",
"onPremisesSamAccountName": "user2"
}
]
}

```

### Environment
OCIS_IMAGE (docker) = stable2.0