Restore non-vendor access to other users' tasks

[NicoPennec]

Problem

• Users with role user/supervisor/manager could no longer see other users' tasks on shared projects since f6751b5, which added an admin-only check on person task endpoints (/data/persons/<id>/tasks, /done-tasks, /task-types/<id>/tasks).
• The commit message described a time-spent restriction, but the check was applied to task endpoints instead — the original intent was to restrict vendors only.

Solution

• Replace the admin check with a vendor-specific guard: vendors can only query their own tasks.
• Other roles fall back to the existing related_projects() filter, restoring the historical behavior.