Refactor ACLR filtering

IMPORTANT MIGRATION STEP: see NXP-13925.

At the SQL level the filtering of rights is done using:

• a join on the hierarchy_read_acl table that materialize the read ACL for each document
• a clause with a subselect that gets the list of allowed read acl for a user using a function: nx_get_read_acls_for

To be efficient the nx_get_read_acls_for use a cache.

The problem is that the query planner don't know how much ACLR will be return by the function nx_get_read_acls_for. This leads to wrong execution plan in some case.

This can be refactored by doing the query in 2 times:

• Use the nx_prepare_user_aclr to build the ACLR user cache aclr_user_map
• Join the cache in the query and a clause AND aclr_user_map.user_id = MD5(principals)

This way the query planner has all the hints to choose the best plan.

Also calling nx_prepare_user_aclr before each query can be optimized later so we call it only once per transaction.