Add `access_type :query_error` to policies.

`access_type :query_error` would cause the rules for policies to be embedded into a query, but raising an error. This is in contrast to being translated into a filter. Can only work for data layers that support the `error/2` expression. For example:

```elixir
policy action_type(:read) do
authorize_if actor_attribute_equals(:foo, 10)
end
```

With `access_type :filter`, a read request would be translated to
```elixir
Resource
|> Ash.Query.filter(foo == 10)
```

With `access_type :query_error`, a read request would be translated to

```elixir
Resource
|> Ash.Query.filter(
if foo == 10 do
error(Ash.Error.Forbidden, ...)
else
true
end
)
```

This allows you to have authorization enforced *with forbidden data never coming back to the server*, without forbidding access to that data. This is useful in specific scenarios where the application wants to know if data is there but being hidden by policies. We can also enable an automatic translation of `:filter` to `:query_error` as an option, for example:

```elixir
Ash.read!(..., authorize_with: :error)
```

To force all filters to instead be treated as errors.

Start by tracing how policy access types are handled and how Ash.Query.filter expressions support the error/2 expression in data layers. Define the query_error behavior, including the optional translation from filter to error for authorize_with: :error, and verify that forbidden data is not returned while its presence remains detectable.

Written by the indexing model from the issue text.