searcher: enforce sub-repo perms at api level

Created by: bobheadxi

A crude implementation of #26647 (closed) by implementing enforcement as high up as possible, right before matches get sent to the client. I believe this covers indexed/unindexed/etc search that goes over repository file contents.

This requires adding searcher to the allowlist of dbconn importers.