Use published_at to hide unpublished blog entries

Note that I intentionally left BlogEntriesController#show using an
unscoped find.

My reasoning is that, without doing so, there'd be no way to preview a
draft entry. At least, not without adding more code to check current
user permissions or similar.

This way, a user can preview an entry if they know the ID (or use "Show
in App" from admin). It's true that anyone who knows or can guess an
entry's ID will be able to view the post regardless of publish state,
but I think that's an acceptable "risk".