Add permission checks on `invoice_discounting.get_invoices`

The method returned unpermissioned invoice data; whitelist enforcement now honors read permission on Invoice.