Rework access control for `ElasticSearchViewsQuery`

Part of the access control is done in the routes and part of it is done directly in the `ElasticSearchViewsQuery`which is confusing, those operations should all be done in `ElasticSearchViewsQuery`

Start by locating the routes and the ElasticSearchViewsQuery implementation, then trace where access control is currently applied in each. Consolidate the access-control operations in ElasticSearchViewsQuery while preserving the existing behavior; done means the routes no longer perform part of this responsibility.

Written by the indexing model from the issue text.