Restrict access to non-public profiles

[betsyecastro]

This PR is to address the first vulnerability in the HackerOne report

• Removes public parameter from the profiles search
• The index endpoint returns only public profiles. In case that a requested profile is private, the search will return an empty array
• Adds conditional to the profile view policy to allow access based on whether the profile is public or not when the context is API. An 403 Forbidden error will be returned by the show endpoint when a private profile is requested.

[betsyecastro]

To do:

1. Fix url for API request to populate people picker to remove public parameter and any other request that uses the API index endpoint
2. Modify API documentation