Refactor auth filtering to be more efficient

[mbklein]

This PR refactors the way auth filters are applied to search queries. Currently, an auth filter is calculated based on what should be excluded, then the entire query (regardless of type) is wrapped in a { bool: { must: [query], must_not: [filters] } } structure. (There is a slightly different method for hybrid queries, but it just involves applying the above struct to every query in hybrid.queries[].)

This refactor calculates the auth filter based on what should be included, and then applies it depending on the query type:

• For regular queries not covered by the following special cases, it wraps the query in bool: { must: [query], filter: [filters] }
• For bool queries, it leaves the existing structure alone and adds the necessary filters to bool.filter
• For neural queries, it adds the filters to neural[field].filter as a new bool filter
• For hybrid queries, it applies the above rules to each query in hybrid.queries[].

The result is a much more efficient and focused query.

The PR also adds an optional visibility query parameter to all search routes, both GET and POST. If present, it will limit the auth filter based on the values provided, but never expand the scope beyond what the user's token allows. For example:

• Anonymous user: ["Institution", "Public"] + Query param: visibility=private,public = { terms: { visibility: ["Public"] } }
• Reading room user: ["Private", "Institution", "Public"] + Query param: visibility=private,institution = { terms: { visibility: ["Private", "Institution"] } }

If the main query also includes visibility constraints, the most restrictive filter will apply.

In addition to increasing efficiency, this will allow us to build simpler queries downstream (DC, MCP) and leave the heavy lifting to the API where it belongs.

[bmquinn]

Searches looking good in my dev env: