Publication and security allow/deny review, fixes, and simplification

@aaronjudd, this should be tested more and the `Security` declarations should be verified before merging into `devel`.

The basic idea here is that I've written security methods that make it clearer what rules are in place for which collections. The rules are also implemented using `deny` functions instead of `allow` because a `deny` function is always called but an `allow` function is potentially skipped if another one already returned `true`.

While doing this, there were some rules that seemed too permissive, so I made some things more strict. You'll want to verify that it was the right thing to do.

I've also cleaned up some of the publication logic. That's on the first commit, so you can see that separate from the new Security stuff.

I just did some basic workflow testing on the branch and didn't encounter issues, but I'm sure there will be some.