Customers shouldn't be able to order unpublished product variation

Problem/Motivation

Right now in getOrderItems() function the requested variation ID is loaded based on SKU without any access checking.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes