R1:c1c897b96117

Provide core policy support for Spaces

Summary:
Ref T8424. No UI or interesting behavior yet, but integrates Spaces checks:

- `PolicyFilter` now checks Spaces.
- `PolicyAwareQuery` now automatically adds Spaces constraints.

There's one interesting design decision here: **spaces are stronger than automatic capabilities**. That means that you can't see a task in a space you don't have permission to access, //even if you are the owner//.

I //think// this is desirable. Particularly, we need to do this…