Permissions refactor.

Move some filtering logic into the model layer instead of Principal.

Remove use of detached criteria, not necessary for our usage.
Remove some old code for cleaning up duplicate attributes.

This does not appear to be a problem any more given that derived product
attributes are working fine. I have confirmed no duplicate attributes
appear after a test data deploy and pool refresh. Likely fixed by
changes to the annotations in the years since this was written.

The cleanup code was causing problems on Hibernate 3 (fixed on 4) with
some incoming changes for how we look up entities.
Return 404's rather than 403 when permissions hide objects.

Wherever possible we try to return 404 to reveal less information.

403 is still used in situations where we can see an object, we just
can't do what we're trying to do. (i.e. an org admin can see the org in
the URL, but it can't delete it)