Ref T10349. Columns have the same policies as the projects they belong to.
However, the current implementation just returns the policy directly. This usually works, but if the project has a policy like "Members of (This) Project", the policy filter tries to check if the viewer is a member of the column itself. That doesn't work, since columns don't have members. This leads to a situation where columns on "Editable By: Project Members" projects can not be edited.
Instead, return a permissive base policy and then use an extended policy to bind the column policy to the project policy.