Media scope

[anatol-sialitski]

There is a security implication: some intranet sites may be protected only by VHost - which is actually a bad practice. Due to this fact we need to introduce VHost config with a list of allowed projects (media projects)

mediaService.scope = <project1:draft>, <project2>

If not specified:

For endpoint mount limit the project to the one specified in site's path (allow from self) /(admin)/site/<project>/<branch>/site-path/_/media/.../<project>(:branch))

For Slash API - allow any project and branch.

Note that content permissions will further limit the access to specific media.