api: resources: only get guest lock after real access check

api: resources: only get guest lock after real access check

The guest iteration is slightly confusing as we also handle the
accumulated pool settings there, so we only check the VM.Audit privs.
for a specific VM and skip to the next if the permissions is not
there after those pool handling.

So, move operations which are only required when VM privs. are there
below this check.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>