WebSearch: restricted records in latest additions

* When a record belongs to both a public and a restricted collection,
  no longer display it in the list of latest additions of the
  public collection (in accordance to the outcome of an empty search query
  over the public collection).
  (closes #1315)

* Amend documentation of CFG_WEBSEARCH_VIEWRESTRCOLL_POLICY
  WRT default policy value.

Signed-off-by: Samuele Kaplun <samuele.kaplun@cern.ch>
@kaplun Yes, the splash pages are not under RBAC, so all restricted records should be removed on those pages for webcolling. Unless `CFG_WEBSEARCH_VIEWRESTRCOLL_POLICY` is permissive.  If it is not permissive, we should not display any record during webcolling.