Tests: added function to test if list items match
Tests: use dummy cache backend

Let's prevent from shooting ourselves in the foot.
Permissions: extend `view` permissions with defaults

Ensures access rights will be extended with those corresponding to the
default users (nobody, default), thus the fully-explicit nature of the
`view` permission is now more relaxed.

Fixes #3344.
Permissions: avoid extra query for admins
Tests: allowed defining negative permissions for permission sets
Permissions: re-introduced the `hide` negative permission

Allows to explicitly forbid users from accessing specific projects. This
commit also merges the `Project.accessible_by_user()` and the
`Project.for_username()` class methods, as the fallback mechanism has been
simplified.

Fixes #3345.