[rikvanriel]

Fix unreadable revisions leaking in search

On the base tree, search_meta and search_meta_page over ALL_REVS
yield the protected revision instead of only the readable one, so
item and global history list revisions the user cannot read. The
count in search_results_size is unfiltered too, leaking how many
private revisions exist, which breaks pagination as well.

The filter has two bugs: ALL_REVS hits carry no indexed
ACL (the schema has no ACL field), so _get_acls treats ACL-less meta
as authoritative and falls back to the configured default; and the
cached allows() key carries no item identity, reusing one item's
verdict for every other item. Fix both: fall through to the storage
ACL lookup when the indexed meta has none, and evaluate _allows
directly in the search filters, where the inner parse/eval/lookup
caches still apply.

Counting now iterates the filtered output of search_meta over every
matching ALL_REVS hit, with the whoosh default limit of 10 lifted.
Cost: one storage lookup per ACL-less item on LATEST_REVS listings
(300 items went from 0 to 300 get_item calls).

[UlrichB22]

@rikvanriel, could you please give an example of how the problem can be reproduced in the UI? I'm worried that this change will have a significant impact on the performance of large wikis.