fix: prevent access to docs in trash from deleted private collections (#2431)

* Check for collection in deleted document

* Add tests

* Use update policy

* Set paranoid to false when fetching deleted doc

* Update policy

server/api/documents.js

@@ -585,6 +585,7 @@ async function loadDocument({
     }
 
     if (document.deletedAt) {
+      // don't send data if user cannot restore deleted doc
       authorize(user, "restore", document);
     } else {
       authorize(user, "read", document);