Add a generic entity access tag to \RestfulEntityBase::getQueryForList()

Make sure we filter out un-accessible items, for the correct account.