Server hidden jobs

** not yet ready for merge--still fixing tests**

This moves the filtering of **excluded** jobs (via the ``exclusion profiles``) to the server, rather than the client.  This improves performance in several ways:
1. reduced payload for every fetch of jobs
2. don't have to download the exclusion profiles to the client, unless editing the profiles themselves
3. don't need special handling on the client to compensate for hidden/non-hidden jobs in counts, and elsewhere
4. don't need to filter for exclusions on every job.  (this is perhaps the biggest one)

The format of the ``flat_exclusions`` has changed, so when we push to dev/stage/production, you have to go into the Sheriff panel and re-save the ``esclusion profiles`` (not each ``job exclusion``)