SECURITY: AdminDetailedUserSerializer#latest_export leaking user exports

There were no guardian checks to ensure that the
`AdminDetailedUserSerializer#lastest_export` attribute can only be
viewed by the right users.

Follow-up: bf75bd3b0ce77750899605c2145c93cd073ef2a1

app/serializers/admin_detailed_user_serializer.rb

@@ -185,6 +185,10 @@ class AdminDetailedUserSerializer < AdminUserSerializer
     UserExportSerializer.new(export, scope:).as_json if export
   end
 
+  def include_latest_export?
+    scope.can_export_entity?("user_archive", object.id)
+  end
+
   def upcoming_changes_stats
     object.upcoming_change_stats(scope)
   end

spec/serializers/admin_detailed_user_serializer_spec.rb

@@ -14,4 +14,16 @@ RSpec.describe AdminDetailedUserSerializer do
     json = serializer.as_json
     expect(json[:name]).to be_nil
   end
+
+  describe "#latest_export" do
+    fab!(:user_export) { UserExport.create!(file_name: "test", user:, upload: Fabricate(:upload)) }
+
+    it "is only included for admins" do
+      serializer = described_class.new(user, scope: Guardian.new(admin), root: false)
+      expect(serializer.as_json[:latest_export][:user_export][:id]).to eq(user_export.id)
+
+      serializer = described_class.new(user, scope: Guardian.new(moderator), root: false)
+      expect(serializer.as_json[:latest_export]).to be_nil
+    end
+  end
 end