Which workspace a campaign is in, for a link that names no workspace

For an old link (`/links/campaigns/<id>`, an email from before workspace URLs), so the app can send the tab to `/links/w/<slug>/campaigns/<id>`. It works across the caller's workspaces: the token may be for any of them. It answers only when Links would let the caller read the campaign in its own workspace: they are a member with a product seat, Links is on there, and campaigns are readable by every member there; archived campaigns are located too. Every other case gets the same 404, byte for byte: no such campaign, one the caller can't read, Links turned off there, a record from before workspaces, a malformed id, or a request made with an API key or an OAuth grant (those are bound to one workspace by consent). Both answers are `Cache-Control: no-store`. Rate-limited per user and per client IP (the edge's CF-Connecting-IP), one limit across the three locate routes.

curl -X GET "https://example.com/v1/campaigns/string/locate"

{  "workspace_id": "0967198e-ec7b-4c6b-b4d3-f71244cadbe9",  "slug": "string"}