[david-rocca]

Closes Issue #2056

Summary

Apply the list endpoint’s username-redaction rule to GET /cve-id/:id and PUT /cve-id/:id. Non-Secretariat users now receive REDACTED when the current owning CNA differs from the original requesting CNA or the reserving user has left that CNA.

Important Changes

src/controller/cve-id.controller/cve-id.controller.js

• Share the username-redaction rule across all three endpoints.
• Check current membership using BaseOrg.users.
• Redact response copies while preserving stored requester UUIDs and PUT audit data.

src/controller/cve-id.controller/index.js

• Document username redaction for list, single-ID, and update responses.

test/integration-tests/cve-id/requesterRedactionTest.js

• Add 15 regression tests covering transfers, departed users, Secretariat access, same-CNA visibility, public responses, and bulk-download behavior.
• Verify stored requester UUIDs remain intact.

test/unit-tests/cve-id/cveIdGetSingleTest.js

• Update the owning-CNA fixture to include stored UUIDs and membership.

Testing

• 1) Reserve an ID as CNA A, transfer it to CNA B, and confirm B receives requested_by.user: "REDACTED" from list and single-ID GET.
• 2) As B, change the ID from RESERVED to REJECTED and confirm updated.requested_by.user is redacted.
• 3) Move the reserving user out of A and verify redaction for IDs still owned by A.
• 4) Confirm Secretariat retains username visibility and same-CNA members retain access when no transfer or departure occurred.