List Review Flags Endpoint

Active do-not-publish flags with provenance, for the Review page.

Scope by share link (the jump from the share editor) or by project(s). All-Projects mode passes projectIds[] the same way /getShares does; the set is then narrowed to the projects where the caller actually holds sharelinks.review.manage, so a union can never surface flags from a project they can't manage.