added "api_access" permission for limiting API access (#4779)

src/API/ActivityController.php

@@ -33,7 +33,7 @@ use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[Route(path: '/activities')]
-#[IsGranted('IS_AUTHENTICATED')]
+#[IsGranted('API')]
 #[OA\Tag(name: 'Activity')]
 final class ActivityController extends BaseApiController
 {