A crude implementation of #26647 (closed) by implementing enforcement as high up as possible, right before matches get sent to the client. I believe this covers indexed/unindexed/etc search that goes over repository file contents.
This requires adding searcher to the allowlist of dbconn importers.
