Determine what endpoints should return 404 when permission is denied

[hasan7n]

Some endpoints (e.g., GET /benchmarks/<bid>/datasets/<did>) should return 404 (or an empty response) if hit by an unauthorized user

[hasan7n]

This will involve refactoring of how permissions are checked.
Currently, database hits are being doubled for permission checks. Better practices can be:

1. when possible, passing database objects to permission classes instead of calling the database from inside the permission class
2. checking permissions inside serializers, for POST requests
3. filtering querysets instead of denying access, for GET requests that return lists