Authenticated inventory disclosure via barcode role bypass

Incorrect authorization in InvenTree before 1.4.0 allows remote authenticated users to read inventory and order data through barcode scans. BarcodeView accepts a caller-supplied model label and primary key, loads the object without permission filtering, and returns its full serializer output without checking the caller's per-model view role. Any account or generally read-scoped token can enumerate keys and disclose parts, stock, pricing, supplier, customer, order, and build data otherwise restricted by role.