Add a unit test for API get_list permissions checking (master)

This adds a unit test to verify that get_list checks permissions for parent
resources properly. The actual fix for this is in Djblets' WebAPIResource.

Testing done: Ran tests
Reviewed at https://reviews.reviewboard.org/r/4559/