Make most repository reads policy-aware

Summary: Ref T603. This swaps almost all queries against the repository table over to be policy aware.

Test Plan:

• Made an audit comment on a commit.
• Ran save_lint.php.
• Looked up a commit with diffusion.getcommits.
• Looked up lint messages with diffusion.getlintmessages.
• Clicked an external/submodule in Diffusion.
• Viewed main lint and repository lint in Diffusion.
• Completed and validated Owners paths in Owners.
• Executed dry runs via Herald.
• Queried for package owners with owners.query.
• Viewed Owners package.
• Edited Owners package.
• Viewed Owners package list.
• Executed repository.query.
• Viewed "Repository" tool repository list.
• Edited Arcanist project.
• Hit "Delete" on repository (this just tells you to use the CLI).
• Created a repository.
• Edited a repository.
• Ran bin/repository list.
• Ran bin/search index rGTESTff45d13dffcfb3ea85b03aac8cc36251cacdf01c
• Pushed and parsed a commit.
• Skipped all the Drydock stuff, as it it's hard to test and isn't normally reachable.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D7132