Filter out search results based on permissions to avoid bugs leaking data

See merge request gitlab/gitlabhq!3493

Return 404 on LFS request if project doesn't exist

See merge request gitlab/gitlabhq!3505

[ci skip]

This will be used later for search filtering.

This is to be more consistent as there is already a :read_note policy in
NotePolicy. To keep other behaviour the same we've introduced a
Note#noteable_ability_name that is used anywhere this was expected.

[ci skip]