Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Prevent access to unjoined groups in the dashboard.

In the dashboard, it's possible to construct a URL to show review
requests for groups that you haven't joined. While normally harmless,
this is problematic for private groups, which should not be accessible.

Now, the only valid groups are those that the user is a member of.
All others will result in a 404.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Don't show private review requests or groups on the user page.

The user page was showing the summaries of private review requests and
the names of invite-only groups, which was an information leak. We now
restrict the lists to those that the viewing user may see.
Release Review Board 1.6.19.