Check all mobile endpoints besides submissions

[esoergel]

Product Description

Make the mobile access restrictions block all mobile endpoints besides form submissions (currently it blocks only the restore endpoint)
https://dimagi-dev.atlassian.net/browse/USH-1399

Technical Summary

Extracted from #30761
Rolling out the restrictions on form submissions will require a bit more legwork, so I'm hoping to merge everything else first.

Feature Flag

USH: Require explicit permissions to access mobile app endpoints

Safety Assurance

Safety story

A version of this has been in use for months on just the restore endpoint. This PR has been on staging for a while now, and I've tested it out as described below, without issue.

Automated test coverage

QA Plan

I tested this on staging and found the expected behavior (though the form submissions changes aren't in this version of the PR)

	restore	case search	form submission
Web Apps (setting disabled)	✔️	✔️	✔️
Mobile (setting disabled)	✔️	✔️	✔️
Web Apps (setting enabled)	✔️	✔️	✔️
Mobile (setting enabled)	❌	❌	❌
Mobile (setting enabled, with permission)	✔️	✔️	✔️

Rollback instructions

• This PR can be reverted after deploy with no further considerations

Labels & Review

• Risk label is set correctly
• The set of people pinged as reviewers is appropriate for the level of risk of the change