GraphQL related objects are not properly restricted

[DanSheps]

Deployment Type

NetBox Cloud

NetBox Version

v4.0.10

Python Version

3.12

Steps to Reproduce

1. Create a site
2. Create an ASN in the site (Ex: 64511, pk=1)
3. Create a user with permissions to only view ASN's (not sites)
4. Run the following GQL: { asn(id: 1) { id, sites {} } }

Expected Behavior

Will show the ASN but not the related site

Observed Behavior

Related site is shown

[DanSheps]

Credit to Jeremy for actually finding this bug when testing the GraphQL PR.