Paginated, read-only, redacted view of workspace/project proposals.

8e06a475 — db.get_workspace_proposals treats project_id as purely optional and applies no additional scope check of its own; calling it with project_id omitted returns every proposal regardless of caller scope. That is a confirmed, still-open product question (see this module's docstring), not something this item's own read surface should duplicate. So: a caller who is themselves project-scoped (_scoped_project_ids_for_request returns a non-None list) MUST name one of their own scoped project_id values here — a 403, not a silent workspace-wide fallback.