Restrict who can call org-specific APIs

[nicholaschiang]

Is your feature request related to a problem? Please describe.
As mentioned in #115, while I did add a UI blocker to prevent users from seeing an org's search results, smart techy people (like me) can still access that data directly via the unrestricted /api/users endpoint.

Describe the solution you'd like
Call the verifyAuth component in the lib/api/routes/users/list.ts API route definition to ensure that the user is authorized to be requesting the given filters (i.e. if they're a member of the org they're filtering by).

[nicholaschiang]

This should also apply to the individual API endpoints and the /api/users/[id]/availability endpoint.

Note: I should also add some Cypress API tests to ensure that those requests fail when they're unauthorized.