open-webui: Socket.IO note authorization bypass via underscore ID

The `ydoc:document:join` handler in `socket/main.py` only checks note ownership when `document_id` starts with `note:`. `YdocManager` normalizes IDs by replacing colons with underscores, so `note_<id>` bypasses the check while accessing the same Yjs document.

Any authenticated user can read the full contents of any other user's private notes by using `note_<id>` instead of `note:<id>`. Private notes may contain sensitive information.

Apply the fix that ensures authorization checks are performed for all document IDs, not just those starting with `note:`. Normalize the document ID before the authorization check so that `note_<id>` is also subject to ownership verification.