Require a viewer to load handles

Summary:
Unmuck almost all of the we-sort-of-have-viewers-some-of-the-time mess.

There are a few notable cases here:

  - I used Omnipotent users when indexing objects for search. I think this is correct; we do policy filtering when showing results.
  - I cheated in a bad way in the Remarkup object rule, but fixing this requires fixing all the PhabricatorRemarkupEngine callsites (there are 85). I'll do that in the next diff.
  - I cheated in a few random places, like when sending mail about package edits. These aren't a big deal.

Test Plan:
  - Grepped for all PhabricatorObjectHandleData references.
  - Gave them viewers.

Reviewers: vrana

Reviewed By: vrana

CC: aran, edward

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D5151

src/applications/diffusion/controller/DiffusionRepositoryController.php

@@ -19,6 +19,7 @@ final class DiffusionRepositoryController extends DiffusionController {
     $history = $history_query->loadHistory();
 
     $browse_query = DiffusionBrowseQuery::newFromDiffusionRequest($drequest);
+    $browse_query->setUser($this->getRequest()->getUser());
     $browse_results = $browse_query->loadPaths();
 
     $phids = array();