[db] default value for project_only allows non-secure access

[Goutham Pacha Ravi]

In a multi-tenant environment, it is critical to have rule based access control tightened around project resources. While fixing two security bugs around loose RBAC [1][2], it was suggested that a fix be made to the base "model_query" to tighten the default value for "project_only" [3]. Setting project_only to "True" by default might prevent further transgressions as resources and APIs continue to be built.

[1] https://bugs.launchpad.net/bugs/1861485
[2] https://bugs.launchpad.net/manila/+bug/1654598
[3] https://opendev.org/openstack/manila/src/commit/947315f0903c823b0fdd9d99c60078814587272c/manila/db/sqlalchemy/api.py#L226-L246

[Vida Haririan (vhariria)]

Additional comments http://eavesdrop.openstack.org/meetings/manila/2020/manila.2020-03-12-15.01.log.html

[Vida Haririan (vhariria)]

See additional related discussions at https://meetings.opendev.org/meetings/manila/2023/manila.2023-03-23-15.00.log.html