R1:e6d8e1a00ac4

Make Herald rules obey policies during application

Summary:
Ref T603. This closes the other major policy loophole in Herald, which was that you could write a rule like:

When [Always], [Add me to CC]

...and end up getting email about everything. These rules are now enforced:

- For a //personal// rule to trigger, you must be able to see the object, and you must be able to use the application the object exists in.
- In contrast, //global// rules will //always// trigger.

Also fixes some small bugs…