R1:cde37acb4bd4

When a custom logo is configured but has a restrictive visibility policy, fall back to the default logo

Summary: Fixes T11982. Currently, configuring a custom logo and then setting the policy restrictively locks off the whole install.

Test Plan:
- Configured `ui.logo`.
- Searched for the file PHID in global search to find the underlying file.
- Set the policy to something restrictive ("only me").
- Purged cache (`bin/cache purge --purge-all`).
- Restarted webserver to nuke APC.
- Loaded a…