Fix access permissions for WebAPIResource.get_list with parent objects.

The list resources didn't do any permissions checking other than the basic
logged-in/local-site checks. This meant that if you had a protected resource
with children, you could get lists of the children even without access to the
parents.

For a concrete example: in Review Board, review requests assigned to an "invite
only group" are visible only to members of that group. If you went to
/api/review-requests/<n>/, you'd get a permission denied, but if you went to
/api/review-requests/<n>/reviews/, you'd get a list of all the reviews on it.

Testing done: Added a unit test to the review board test suite for this case.
Reviewed at https://reviews.reviewboard.org/r/4557/