Deny anonymous access to /api/submissions/ list and retrieve

[ihsaan-ullah]

Description

Anonymous GETs returned full submission records (filenames, status details, fact sheet answers) for any finished leaderboard submission, ignoring is_public. Now returns an empty queryset instead; public leaderboard data is already served by get_leaderboard in PhaseViewSet

Issues this PR resolves

• Repored by Chris Harris

NOTE

This PR reverts part of #1982

A checklist for hand testing

• As a logged-out user, GET /api/submissions/ returns an empty result set even when a competition has finished submissions on a public leaderboard.
• As a logged-out user, GET /api/submissions/{id}/ for a known finished leaderboard submission ID returns 404, while the competition's public leaderboard page (get_leaderboard) still displays scores correctly.

Checklist

• Code review by me
• Hand tested by me
• I'm proud of my work
• Code review by reviewer
• Hand tested by reviewer
• CircleCi tests are passing
• Ready to merge

[ihsaan-ullah]

For some reason the circle test is failing

[ObadaS]

Seems like either MinIO, in their infinite wisdom, decided to delete the image : https://hub.docker.com/r/minio/mc
Or dockerhub is having issues

Small update, they also removed the MinIO images, seems like it's a deliberate act and not a bug. I made a PR to switch registry for those images #2537

[Didayolo]

I'll merge the CircleCI fix and rebase this PR.

From what I see, in addition to the data leakage problem, this PR also fixes possible unauthentificated state changes on is_public property.

Let's include it in the 1.32 release as requested by Chris.