git: Apply sub-repo filtering on git.NewFileReader

Created by: mollylogue

Behavior introduced by this PR:

• If sub-repo permissions is enabled, and the user does not have access to the specified file, git.NewFileReader will return nil. Are we okay with this behavior? If the possibility of a nil reader isn't handled wherever git.NewFileReader is created, we could end up with an exception (i.e. calling defer reader.Close() on a nil reader). Alternatively, we could return an error if the user doesn't have access? I don't have enough visibility into how this is being used to know what's best, but based on some spot checking it does look like we check for a reader being nil or not.

https://github.com/sourcegraph/sourcegraph/issues/28264