Should return 403 when user tries to access project they are not a part of

[jue-henry]

Currently the GetImages, GetImageById, and GetImageCount APIs do not have any permissions checking. We need to add this additional check for the correct project to /src/api/db/models/utils.js's hasRole function.

Add proper role annotation to the functions in the AuthedImageModel?