Fix comment permissions (#28213) (#28216)

backport #28213

This PR will fix some missed checks for private repositories' data on
web routes and API routes.

routers/api/v1/repo/key.go

@@ -159,6 +159,12 @@ func GetDeployKey(ctx *context.APIContext) {
 		return
 	}
 
+	// this check make it more consistent
+	if key.RepoID != ctx.Repo.Repository.ID {
+		ctx.NotFound()
+		return
+	}
+
 	if err = key.GetContent(); err != nil {
 		ctx.Error(http.StatusInternalServerError, "GetContent", err)
 		return