chore(policy): inject auth guard for 'list' operation in policy utils

Author: genu

packages/runtime/src/enhancements/node/policy/policy-utils.ts

@@ -612,6 +612,11 @@ export class PolicyUtil extends QueryUtils {
             return false;
         }
 
+        if (!this.injectAuthGuardAsWhere(db, injected, model, 'list')) {
+            args.where = this.makeFalse();
+            return false;
+        }
+
         if (args.where) {
             // inject into fields:
             //   to-many: some/none/every