Fix an issue where loading a mangled project graph could fail too abruptly

Summary:
Ref T13484. If you load a subproject S which has a mangled/invalid parentPath, the query currently tries to execute an empty edge query and fatals.

Instead, we want to deny-by-default in the policy layer but not fail the query. The subproject should become restricted but not fatal anything related to it.

See T13484 for a future refinement where we could identify "broken / data integrity issue" objects explicilty.

Test Plan:

• Modified the projectPath of some subproject in the database to QQQQ....
• Loaded that project page.
• Before patch: fatal after issuing bad edge query.
• After patch: "functionally correct" policy layer failure, although an explicit "data integrity issue" failure would be better.

Maniphest Tasks: T13484

Differential Revision: https://secure.phabricator.com/D20963