Consider audience when checking private permissions

[Betree]

Fix https://github.com/opencollective/opencollective/issues/5842

I'm making a quick fix for this, but we'll need to iterate and implement a real loader. Also used this as an opportunity to deprecate GQLV1's updates.