Automated cherry pick of #35562 (#36095)

* adds team member data sanitizing (#35562)

* adds team member data sanitizing

* assert using require

* adds data sanitizing to team members for user endpoint

* team admin data visibility now tests with different user

(cherry picked from commit 2be57a7ec0c67004b77c76386f20a630920196e3)

* removes wrong argument in test helper calls

* fix: add explicit permission grant in team members test (#36007)

* fix: add explicit permission grant in team members test

TestGetTeamMembersForUserRoleDataSanitization was relying on a permission
side-effect leaked from concurrent tests. Under fullyparallel, another test
temporarily adds PermissionReadOtherUsersTeams to system_user role, which
the team admin subtest accidentally benefits from. Under sequential execution
(binary parameters mode), no concurrent test leaks this permission, so the
team admin correctly gets 403.

Fix by explicitly granting ReadOtherUsersTeams in the subtest setup, matching
the pattern used in adjacent subtests.

Release Note
NONE

Co-authored-by: Claude <claude@anthropic.com>

* fix: remove explanatory comment per review feedback

---------

Co-authored-by: Claude <claude@anthropic.com>

* removes extra arg from test helper call

---------

Co-authored-by: Carlos Garcia <carlos.garcia@mattermost.com>
Co-authored-by: Pavel Zeman <pavel.zeman@mattermost.com>
Co-authored-by: Claude <claude@anthropic.com>

server/public/model/team_member.go

@@ -142,3 +142,14 @@ func (o *TeamMember) PreUpdate() {
 func (o *TeamMember) GetRoles() []string {
 	return strings.Fields(o.Roles)
 }
+
+func (o *TeamMember) SanitizeRoleData(currentUserId string) {
+	if o.UserId != currentUserId {
+		o.Roles = ""
+		o.ExplicitRoles = ""
+		o.SchemeAdmin = false
+		o.SchemeGuest = false
+		o.SchemeUser = false
+		o.DeleteAt = -1
+	}
+}