Add missing loan permission checks across lending APIs

Added permission checks to whitelisted lending APIs that were reading or changing loan data without verifying the caller's access to those records.