added "api_access" permission for limiting API access (#4779)

src/API/UserController.php

@@ -33,7 +33,7 @@ use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[Route(path: '/users')]
-#[IsGranted('IS_AUTHENTICATED')]
+#[IsGranted('API')]
 #[OA\Tag(name: 'User')]
 final class UserController extends BaseApiController
 {