`/version_files/update` returns nothing for projects awaiting review

[VulpineFriend87]

Please confirm the following.

• I checked the existing issues for duplicate problems
• I have tried resolving the issue using the support portal

Describe the bug

For a project whose status is processing, POST /v2/version_files/update returns an empty map for a hash it demonstrably knows about, while every other route serves that same project normally to the same authenticated project member.

The result is a 200 with {}

Of the four routes an update-checking client needs, three serve an unapproved project and one does not:

Route	Project awaiting review
POST /v2/version_files (identify by hash)	returns the version
GET /v2/project/{id}/version	returns all versions
POST /v2/version_files/update	returns {}
CDN download of the version's file	works (anonymously as well)

Steps to reproduce

With a PAT that is a member of a project whose status is processing:

TOKEN=...            # PAT with read access to projects
HASH=...             # sha512 of a file belonging to a version of that project
UA='vulpine/whatever/1.0'

# identify the hash
curl -s -X POST -H "Authorization: $TOKEN" -H "User-Agent: $UA" \
     -H "Content-Type: application/json" \
     -d "{\"hashes\":[\"$HASH\"],\"algorithm\":\"sha512\"}" \
     https://api.modrinth.com/v2/version_files
# -> { "<hash>": { "id": "...", "version_number": "0.5.0", ... } }

# update
curl -s -X POST -H "Authorization: $TOKEN" -H "User-Agent: $UA" \
     -H "Content-Type: application/json" \
     -d "{\"hashes\":[\"$HASH\"],\"algorithm\":\"sha512\"}" \
     https://api.modrinth.com/v2/version_files/update
# -> {}

(a newer version of that project exists)

performing the same calls with the same token against an approved project works in both cases.

Expected behavior

/version_files/update serves projects the requester can already see through /version_files and /project/{id}/version

Additional context

No response