API requests for an non-existent resources should return 404

[amrita-shrestha]

Describe the bug

If a resource doesn't exist then the API request should return a 404
we don't want to expose the existence of resources if a user has no access to them, so we return a 404 Not Found instead of a 403 Forbidden.

Steps

1. Scenario Outline: user other than the admin tries to add user to a nonexistent group

Expected behavior

Http status code should be 404

Actual behavior

Http status code 401 or 4xx

[amrita-shrestha]

discussed in #5742 (comment)

[saw-jan]

Non-admin user trying to add user to non-existent group returns 403 Forbidden 👍
Admin user trying to add user to non-existent group returns 404 Not found 👍