Make `rooms/{room}/leaderboard` API endpoint not require user

[cl8n]

Slice: Is there a reason why this api endpoint requires a resource owner? As far as I'm aware rooms are public so having to authenticate with a user just to access public information seems unnecessary.

it requires a user for the part that returns the current user's score, but the rest of the endpoint should still function without one