Call didRejectResult() in DiffusionCommitQuery properly

Summary:
Ref T4345. This error is per object-type in the query implementations, not a mail/permissions issue.

Without didRejectResult(), we can't distinguish between "restricted" and "unknown" for objects filtered by willFilterPage().

• Call didRejectResult() on commits.
• Make didRejectResult() handle both existing policy exceptions and filtering.
• Recover from partial objects (like commits) which are missing attached data required to figure out policies.

Test Plan: Saw "Restricted Diffusion Commit" instead of "Unknown Object (Diffusion Commit)" when viewing nonvisible commit handle in Maniphest.

Reviewers: btrahan, joshuaspence

Reviewed By: joshuaspence

Subscribers: epriestley

Maniphest Tasks: T4345

Differential Revision: https://secure.phabricator.com/D13289