User typeahead can be abused to determine values of admin-only fields

Describe the bug

We don't explicitly show the email addresses of other users, but by trial and error it's quite easy to figure out what a user's email address is by filtering users by their email. So, that probably shouldn't be allowed (unless you're allowed to see the user's email, probably?)

Fix ideas
I tried adding the admin required policy to filter fields, but you get the error:
1. The specified directive @authorizeis not allowed on the current locationInputFieldDefinition. (LexBoxApi.GraphQL.CustomTypes.UserFilterType).

We could explicitly set email and username to null for users that are not "managed by" the requesting user. Which would effectively disable filtering by those fields. We're already doing that in the scope of an org. I think UsersICanSee is the only query where we'd need to do that. Something like this: 😬

    public IQueryable<User> UserQueryForTypeahead(LexAuthUser user)
    {
        var myOrgIds = user.Orgs.Select(o => o.OrgId).ToList();
        var myManagedOrgIds = user.Orgs.Where(o => o.Role == OrgRole.Admin).Select(o => o.OrgId).ToList();
        var myProjectIds = user.Projects.Select(p => p.ProjectId).ToList();
        var myManagedProjectIds = user.Projects.Where(p => p.Role == ProjectRole.Manager).Select(p => p.ProjectId).ToList();
        return dbContext.Users
            .Select(u => new
            {
                user = u,
                iSee = u.Id == user.Id ||
                    u.Organizations.Any(orgMember => myOrgIds.Contains(orgMember.OrgId)) ||
                    u.Projects.Any(projMember =>
                        myManagedProjectIds.Contains(projMember.ProjectId) ||
                        (projMember.Project != null && projMember.Project.IsConfidential != true && myProjectIds.Contains(projMember.ProjectId))),
                iManage = u.Organizations.Any(orgMember => myManagedOrgIds.Contains(orgMember.OrgId))
            })
            .Where(u => u.iSee)
            .Select(u => u.iManage ? u.user : new User { Id = u.user.Id, Name = u.user.Name });
    }

Start with UsersICanSee and UserQueryForTypeahead, then inspect LexBoxApi.GraphQL.CustomTypes.UserFilterType and its authorization handling. Verify how typeahead filtering exposes email and username to users who do not manage the target user. Done means unauthorized users cannot infer those fields through filtering while permitted users retain the intended access.