Fix unauthorized column reordering

Users could reorder columns they didn't have access to. Fixed by
limiting ColumnScoped to User::Accessor#accessible_columns.

References https://hackerone.com/reports/3449905

test/controllers/columns/left_positions_controller_test.rb

@@ -20,4 +20,17 @@ class Columns::LeftPositionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal original_position_b, column_a.reload.position
     assert_equal original_position_a, column_b.reload.position
   end
+
+  test "users can only reorder columns in boards they have access to" do
+    column = columns(:writebook_in_progress)
+
+    post column_left_position_path(column), as: :turbo_stream
+    assert_response :success
+
+    boards(:writebook).update! all_access: false
+    boards(:writebook).accesses.revoke_from users(:kevin)
+
+    post column_left_position_path(column), as: :turbo_stream
+    assert_response :not_found
+  end
 end

test/controllers/columns/right_positions_controller_test.rb

@@ -20,4 +20,17 @@ class Columns::RightPositionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal original_position_b, column_a.reload.position
     assert_equal original_position_a, column_b.reload.position
   end
+
+  test "users can only reorder columns in boards they have access to" do
+    column = columns(:writebook_triage)
+
+    post column_right_position_path(column), as: :turbo_stream
+    assert_response :success
+
+    boards(:writebook).update! all_access: false
+    boards(:writebook).accesses.revoke_from users(:kevin)
+
+    post column_right_position_path(column), as: :turbo_stream
+    assert_response :not_found
+  end
 end