Fix EZP-22333: SQL error in tagcloud with object state policies

JIRA: https://jira.ez.no/browse/EZP-22333

Problem:
createPermissionCheckingSQL() returns sql with JOINS for state permission checking, while trying to use ezcontentobjectid which is not yet available.
This fixes it by performing a `LEFT JOIN` with ezkeyword, and moving the permission checking to the end.