Restrict free text field routes so that private device/platform/site can only be accessed by owner

@marc.hanisch mentioned the issue when testing the frontend integration of the free text field completion. Currently we can add data for private devices and those will be accessible for autocompletion for other users as well.

We need to restrict it, so that either:

• the associated device/platform/site is not private
• or the owner that makes the request is the creator of that private device/platform/site.