Fix incorrect order of auth and alias filtering

The logic used by `annotator.annotation.Annotation._build_query`
to expand the search to include document aliases and to limit the
search by authorization were inverted. The former assumed a
structure only present when the latter was active via the `AUTHZ_ON`
application setting.

This problem could cause information leakage. No release tags include
this problem.