Move permission code to registry

As much as possible, the permission verification should be specified
and performed in the active registry.

The AJAX views responsibile for checking lookup permission now respect
the registry permission by not declaring their own, which previously
eclipsed registry settings.  The AJAX views should not contain logic
necessary for the local search app to subclass and modify.

One outstanding problem is that only the default
`appsearch.registry.search` registry is used, as there is no convenient
location to specify a custom registry, even though BaseSearchView
appears to allow for such a thing.  The base view and the AJAX views do
not have a way to share that information.