activitypub.collection.get: the totalItems number include items we cannot see

This is because we do a first query to find the number of items in the collections (and in this query the WebACL don't apply as they are related to the collection, not the items). And then we query each item. But the `totalItems` returned does not reflect the permissions errors we may have.

Start at the activitypub.collection.get entry point and trace the initial collection-count query alongside the per-item queries. Verify how WebACL permission errors are handled, then confirm that totalItems reflects only items visible to the requester.

Written by the indexing model from the issue text.