invoicejob: cross-tenant GET/PATCH/DELETE returns 403 — same class as #229 (secure-404)

[CryptoJones]

Same class as the 12 prior secure-404 fixes, now on job-cascade-scoped InvoiceJob (injbJobId → Job.jobCustId → Customer.custCompId). Collapse 403 "exists but not yours" into 404.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/