Protect object loading

Ensure an object belongs to the current Organization after it is fetched from the database.

We will have different types of checks with different performance profiles:

Objects sharded by organization_id

These results will have objects with an organization that should be comparable against the Current.organization. These will be fast.

Objects sharded by namespaces and projects

These could require a database query to resolve the Organization associated with the Namespace or Project. Systematic secondary queries may not be an acceptable solution? (Or maybe they are)

Unsharded objects

No filtering needed.

This relates to #548429