GET /api/v2/workspaces/{id}/acl was authorized only by ActionRead on the
workspace, but escalated to the System context to fetch each ACL group's
full member roster (including member email, last seen, login type, status,
and created at) and returned it directly to the caller. A user merely
shared a workspace could therefore enumerate the PII of every member of
every group on that workspace's ACL.

Return the group identity and total member count only, omitting the member
roster for all callers. This matches the chat ACL and template
available-ACL endpoints, which already use GetGroupMembersCountByGroupIDs
and leave the roster empty.

Addresses ANT-2026-22459.