Document fetching checkout/order by ID without permissions

[maarcingebala]

Saleor allows users to fetch checkout and orders by ID without permission. Since this might be considered a security risk, we should document how it works in more detail.

• Checkout and order GraphQL IDs are based on a hard-to-guess UUID. As long as it is not shared anywhere, you need to know the ID to fetch these objects.
• When the user field is set (i.e., a checkout/order is associated with a user account), it won't be returned when querying without an auth token. The user field can be fetched only by the owner.

Sections where this should be mentioned:

• https://docs.saleor.io/docs/3.x/developer/checkout/overview
• https://docs.saleor.io/docs/3.x/api-reference/orders/queries/order
• https://docs.saleor.io/docs/3.x/api-reference/checkout/queries/checkout

[timuric]

Use case:
Sending email with order confirmation you a link to "track the status of your order" without signing in, similar to how delivery service tracking emails work

[timuric]

Document path 'core concepts > checkout > permissions'