* test: do not clone private bases
* fix(frontend): deny access for private bases
* fix(backend): validate request on creation
* test(auth): deny clone for no public base
* test(auth): allow and deny clone request
* fix(auth): validate access to create machine