matchesDefault answered 'is this user a leader of ANY team' without looking
at which team owns the resource, so once a real TeamLeadLookup is wired a
leader of one team could use (read) another team's resource shared at that
level. Thread the owning team id through canUseResource and require
leadership of THAT team; resources with no owning team (portal /
server-scoped) keep admitting any lead, which is the intended semantic
there. Dormant today: the only TeamLeadLookup is the always-false no-op.