fix: add project ownership check to getMilestone() to prevent IDOR (#3657)

The getMilestone() method had #[RequiresPermission] without projectIdParam
and lacked a body-level project ownership check. Any authenticated user
could read milestones from projects they don't belong to by guessing
milestone IDs.

Compare with getTicket() which properly verifies project assignment via
isUserAssignedToProject().

CWE-639 (Authorization Bypass Through User-Controlled Key)
CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (7.5)

Co-authored-by: Claude <noreply@anthropic.com>

Author: javokhir-sec

app/Domain/Tickets/Services/Tickets.php

@@ -2910,10 +2910,18 @@ public function quickUpdateMilestone($params): array|bool
      *
      * @api
      */
-    #[RequiresPermission(TicketsPermissions::VIEW)]
+    #[RequiresPermission(TicketsPermissions::VIEW, projectIdParam: 'id')]
     public function getMilestone(int $id): TicketModel|bool
     {
-        return $this->ticketRepository->getTicket($id);
+        $milestone = $this->ticketRepository->getTicket($id);
+
+        // Verify the user is assigned to the milestone's project.
+        // Mirrors the authorization check in getTicket().
+        if ($milestone && $this->projectService->isUserAssignedToProject(session('userdata.id'), $milestone->projectId)) {
+            return $milestone;
+        }
+
+        return false;
     }
 
     /**