Apply ACL restriction filters for a search query

I we rename it, maybe something like `flags_bitmask` is more explicit.