Fix review endpoints to allow access for users with courses.view_library_updates permission #441

Description

It is necessary to review and fix the endpoints corresponding to the review of changes in the Library updates page in Course Authoring. Currently, these endpoints prevent certain users from viewing pending changes if they lack read permissions on the library. The goal is to ensure that any user with the courses.view_library_updates permission can access and review the changes, replicating a similar logic and solution previously applied to the sync endpoint (#419)

Expected Behavior

A user with the courses.view_library_updates permission should be able to execute the review endpoints and view the information correctly (e.g., an HTTP 200 response), regardless of whether they have the general view permission for that library.

Current Behavior

The review endpoints are failing and blocking access (likely returning an HTTP 403 Forbidden error) when a user attempts to review changes without having the view permission on the library, even though the user does possess the courses.view_library_updates permission.

Affected Endpoints

• /api/libraries/v2/containers/<library_unit_id>/children/?published=true
• /api/libraries/v2/containers/<library_unit_id>/
• /xblocks/v2/lb:Demo:L1:html:92963022-f922-460c-8950-f3887591035b/embed/student_view/?version=published

Content

Reported in #286 (comment)

Steps to reproduce

1. Create or use a test user in the system.
2. Ensure the user does not have the general view permission for a specific library that has pending changes.
3. Grant this user the courses.view_library_updates permission, by assigning any course role, such as Course Auditor.
4. Attempt to access the review changes view (or make a direct request to the review endpoints) for that library.
5. Observe that the system throws a permission error and prevents the user from viewing the changes.