[HLAPI] Expanded permission checks

[cconard96]

Checklist before requesting a review

• I have read the CONTRIBUTING document.
• I have performed a self-review of my code.
• I have added tests that prove my fix is effective or that my feature works.
• This change requires a documentation update.

Description

This will address the last major blocker, AFIAK, with the new API for the stable GLPI 11 release.

Expand permission checks and some GraphQL handling:

• Add more item-level checks and more unit tests related to permissions.
• Rely on permission checking at the Search level instead of a middleware to account for permissions on indirectly requested itemtypes (GraphQL). For example this query is requesting Computers as the main itemtype, but also States which have different permissions:

query {
    Computer(limit: 10) {
        id
        status {
            name
            visibilities {
                computer
                monitor
            }
        }
    }
}

• Fix GraphQL response having null values at incorrect levels when missing permissions.
• Fix GraphQL response not including errors from the API.
• Prevent expanding the schemas of itemtypes the user cannot view. For example, if a user can view Computers but not "Statuses of items", the user can see the computer with the ID and Name of the status (included directly in the Computer schema), but none of the expanded properties from the State schema like visibilities.
• Add a "fast-fail" functionality to the read permission SQL restriction criteria. If a schema returns false for x-rights-critieria['read'], we know the user cannot view any of that itemtype so we can avoid querying the DB completely. This avoids sending a query with a condition like "1=0" which will resolve as false and return nothing anyways.
• Fix HTTP status codes used for some API error responses.

This was originally waiting for another PR which may have reduced duplication on the SQL criteria between the new API and the search engine but that is a complex thing to make generic enough, notably with the different table aliases being used, and it is too late to continue that work for GLPI 11.0.