Fix IDOR in Kits, BroadcastAnnouncements, and Distributions controllers

[costajohnt]

Summary

Fixes cross-organization IDOR vulnerabilities (CWE-639) in three controllers by scoping all find(params[:id]) calls through current_organization:

• KitsController — deactivate, reactivate, allocations, allocate (4 endpoints)
• BroadcastAnnouncementsController — set_broadcast_announcement before_action used by edit, update, destroy (3 endpoints)
• DistributionsController — print, show, edit, update, destroy (5 endpoints)

Previously, these endpoints used unscoped Model.find(params[:id]), allowing an authenticated user from one organization to access, modify, or delete records belonging to a different organization by guessing or enumerating IDs.

Changes

• Replaced Kit.find(params[:id]) with current_organization.kits.find(params[:id]) in 4 actions
• Replaced BroadcastAnnouncement.find(params[:id]) with BroadcastAnnouncement.where(organization_id: current_organization.id).find(params[:id]) (no has_many association available)
• Replaced Distribution.find(params[:id]) / Distribution.includes(...).find(params[:id]) with current_organization.distributions.find(params[:id]) in 5 actions
• Added organization-scoped guard in destroy before delegating to DistributionDestroyService

Test Plan

• Added cross-organization request specs for all fixed endpoints:
  • KitsController: deactivate, reactivate, allocations, allocate (4 tests)
  • BroadcastAnnouncementsController: edit, update, destroy (3 tests)
  • DistributionsController: print, show, edit, update, destroy (5 tests)
• Each test creates a resource in a different organization and verifies a 404 response
• For destructive actions (update, destroy), tests also verify the record is unchanged

Partial fix for #5509 (3 of 5 controllers).