Reworked support for checking allowed apps on entities. Descriptors that support this should now implement AppRestrictedDescriptor