Website: Reduce Android Management API usage (#49065)

Related to: https://github.com/fleetdm/fleet/issues/41908

Changes:
- Updated Android proxy endpoints (`create-android-enrollment-token`,
`create-enterprise-webapp`, `delete-android-device`,
`get-android-device`, `get-android-devices`,
`get-enterprise-applications`, `issue-command-on-android-device`,
`modify-android-device`, `modify-android-policies`, and
`modify-enterprise-app-policy`) to send requests to the Android
Management API without verifying that an enterprise is still managed by
Fleet with the getIsEnterpriseManagedByFleet helper, and to return a
`enterpriseNotAccessible` (notFound) response to Fleet servers if the
Android management API returns a 403 response.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved Android management flows to handle authorization failures
more consistently.
* Requests now return a clearer “not accessible” response when access to
an Android enterprise is denied.
* Several Android device, app, policy, and enterprise actions now
surface this response instead of falling back to generic errors.
* Streamlined Android enterprise operations by removing an extra
pre-check, letting the API response determine the final outcome.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

website/api/controllers/android-proxy/get-android-device.js

@@ -24,6 +24,7 @@ module.exports = {
     missingAuthHeader: { description: 'This request was missing an authorization header.', responseType: 'unauthorized'},
     unauthorized: { description: 'Invalid authentication token.', responseType: 'unauthorized'},
     notFound: { description: 'No Android enterprise found for this Fleet server.', responseType: 'notFound' },
+    enterpriseNotAccessible: { description: 'Fleet is not authorized to manage this Android enterprise.', responseType: 'notFound' },
     deviceNoLongerManaged: { description: 'The device is no longer managed by the Android enterprise.', responseType: 'notFound' },
   },
 
@@ -54,13 +55,6 @@ module.exports = {
       throw 'unauthorized';
     }
 
-    // Check the list of Android Enterprises managed by Fleet to see if this Android Enterprise is still managed.
-    let isEnterpriseManagedByFleet = await sails.helpers.androidProxy.getIsEnterpriseManagedByFleet(androidEnterpriseId);
-    // Return a 404 response if this Android enterprise is no longer managed by Fleet.
-    if(!isEnterpriseManagedByFleet) {
-      throw 'notFound';
-    }
-
     // Get the device for this Android enterprise.
     // Note: We're using sails.helpers.flow.build here to handle any errors that occur using google's node library.
     let getDeviceResponse = await sails.helpers.flow.build(async () => {
@@ -85,6 +79,9 @@ module.exports = {
       // If the Android management API returns a 429 response, log an additional warning that will trigger a help-p1 alert.
       sails.log.warn(`p1: Android management API rate limit exceeded!`);
       return new Error(`When attempting to get a device for an Android enterprise (${androidEnterpriseId}), an error occurred. Error: ${err}`);
+    }).intercept({status: 403}, ()=>{
+      // If the Android management API returns a 403 response, return a enterpriseNotAccessible (notFound) response to the Fleet server.
+      return {'enterpriseNotAccessible': 'Fleet is not authorized to manage this Android enterprise.'};
     }).intercept((err)=>{
       let errorString = err.toString();
       if (errorString.includes('Device is no longer being managed')) {