`activitypub.collection.get` exposes private items

When `GET`ting my inbox without authentication (https://mypod.store/laurin/inbox?page=1), I can see private activities (at least the first layer of them).

The events themselves are private. Ideally, the inbox should be empty for me, unless the activity was public.

Partly related to https://github.com/assemblee-virtuelle/semapps/issues/1136

Start by reproducing the unauthenticated request at the reported inbox URL and tracing the `activitypub.collection.get` entry point. Compare the returned activities with their public/private visibility, including the first layer, and consider the issue done when unauthenticated collections contain only public activities.

Written by the indexing model from the issue text.