Allow an organization to be read-only to the world

[sschuberth]

There are cases, like for a public demo instance of ORT Server, where one would like even unauthenticated users (but also any authenticated users, independent of their permissions) to be able to see product runs in an organization. This currently does not seem to be possible, as all relevant API calls currently require authentication, and permissions are given for each user, with there's no ability to set organization public even for all authenticated users.