Get Workspaces

The workspaces this caller can act in.

Membership-scoped: this populates the workspace switcher, and a member has no business knowing that workspaces they were never added to exist. An org admin belongs to every workspace in the organization, and a user with no membership rows anywhere belongs to the default one.