NXQL queries should not return versions to a user that does not have ReadVersion permission

A user that does not have ReadVersion permission is able to browse or view versioned documents.

For example, contribute the following to override the Read permission so that ReadVersion is removed:

  <extension point="permissions" target="org.nuxeo.ecm.core.security.SecurityService">
      <permission name="Read">
          <remove>ReadVersion</remove>
      </permission>
  </extension>

Create a container containing one or more documents. Update one or more of the documents so that there are versions. Set the permission on the container for a regular user, and browse the container as that user. User will have ability to query and view all versions of each document.