Correct overbroad automatic capability grant of global settings objects

Summary:
Ref T13679. In D16983, global settings objects were given an exception to let logged-out users see them, even on installs with no "public" user role.

This exception is too broad and grants everyone all capabilities, not just "CAN_VIEW". In particular, it incorrectly grants "CAN_EDIT", so any user can edit global settings defaults.

Restrict this grant to "CAN_VIEW".

Test Plan:

• As a non-administrator, tried to edit global settings.
• Before: could.
• After: could not.

Maniphest Tasks: T13679

Differential Revision: https://secure.phabricator.com/D21811