Calculate `PublicOnly` for org membership only once

[6543]

Refactoring of #32211

this move the PublicOnly() filter calcuation next to the DB querys and let it be decided by the Doer

---

Sponsored by Kithara Software GmbH

[lunny]

As a habit, we almost check permission in service layer but not in models layer. What's the problem with the previous code?

[6543]

I can create a new func in the service witch checks permissions ... but we would have to alter the existing code a lot and i want to only touch it here for a explizite context ... : the refactoring that makes the #32211 diff smal

[6543]

What's the problem with the previous code?

the determination if a user can see public or private org membership is determined in different places ... I want to have that check in a single place ...

[6543]

@lunny to https://github.com/go-gitea/gitea/pull/32234#discussion_r1797948165 i tryed: https://github.com/go-gitea/gitea/pull/32234/commits/3af5ae7ade0b78313e8dbee1130be0b266f6ac8c

see https://github.com/go-gitea/gitea/actions/runs/11331009974/job/31510076461?pr=32234

it does not work, it errors with: Unsupported condition type

[6543]

(I tried to have a single source of truth for the query ... but if preferred i will just use duplicated code by have a builder version and classic xorm version)

[6543]

https://github.com/go-gitea/gitea/pull/32234#discussion_r1798326245

this needs an answer to move forward from @lunny ...

[6543]

@lunny made 7bb645eaa959b43a878afdbb3057df47a29cfac4 here and https://github.com/go-gitea/gitea/pull/32211/commits/8780d12df415290ff27b0da820988e7834aca5b7 ...

[6543]

@lunny anything else?

[6543]

thanks :heart: !