🐛(backend) fix invitations API endpoint access rights

Only users who have the rights to manage accesses on the document should
be allowed to see and manipulate invitations. Other users can see access
rights on the document but only when the corresponding user/team has
actually been granted access.

We added a parameter in document abilities so the frontend knows when
the logged-in user can invite another user with the owner role or not.

CHANGELOG.md

@@ -16,6 +16,7 @@ and this project adheres to
 
 ## Fixed
 
+- 🐛(backend) require right to manage document accesses to see invitations #369
 - 🐛(frontend) add default toolbar buttons #355
 
 
@@ -29,7 +30,7 @@ and this project adheres to
 
 ## Changed
 
-- ♻️(frontend) More multi theme friendly #325
+- ♻️(frontend) more multi theme friendly #325
 - ♻️ Bootstrap frontend #257
 - ♻️ Add username in email #314