Search: add support for membership sites

Membership sites are some combination of public and private content that need to allow end users to search both logged in and not. Currently we don't have a consistent way to differentiate that content, and we don't have a way to correctly authorize access to the search. It is very easy to leak data.

For private sites we are proxying through the main site. Maybe all membership sites need to proxy and then we add the filters as we proxy the request? So we treat the site as fully private for search, but allow authenticated searches. This reduces the speed of the API, but maybe the tradeoff is worth it.

The issue does not name files, tests, or entry points. Start by clarifying how membership content is identified and how authenticated versus anonymous searches should be authorized; done means both search modes work without exposing private content.

Written by the indexing model from the issue text.