A3: `permission.can` warnings and potential permission check escape for pieces relationship built-in filters

**Somewhat related with #3626**

The same console warning as described in the linked issue above is present without any custom projections but using the piece built in relation filter (think of articles filtered by a tag). The strange part is it is only present when no user is logged in.

**A demo repo reproducing the problem:** https://github.com/myovchev/apos-issue-3626
**In order to reproduce:** install, create an article, assign a tag, create and navigate to an article page type, click the tag, logout and look at the console logs.

The main suspect: https://github.com/apostrophecms/apostrophe/blob/main/modules/%40apostrophecms/schema/index.js#L2180
but it doesn't explain (to me) why the warning is present only in non-logged-in state.

Start with the demo repository and reproduce the built-in piece relationship filter flow: create an article, assign a tag, open the article page type, click the tag, and compare logged-in and logged-out console output. Then inspect modules/@apostrophecms/schema/index.js around line 2180. Done means the warning and any unintended permission-check escape are resolved in both authentication states.

Written by the indexing model from the issue text.