🚀 Feature: Add support of relations to Permission framework

### 🔖 Feature description

The current implementation of the Permission Framework doesn't cover the `relation` section on other entities' manifests where the subject entity can be listed as `targetRef`.
As a consequence not permitted entities can be still spotted via "Inspect entity" popup.

### 🎤 Context

In my use case, we have a bunch of components where the name includes sensitive information. We have hidden access to component pages by permission policy. However, these entities still have security concerns due to being visible on the system they are related to.

### ✌️ Possible Implementation

There is already present filtering of data on the backend: https://github.com/backstage/backstage/blob/master/plugins/catalog-backend/src/service/createRouter.ts#L126

At the moment there is neither depth to filter by nested fields nor the ability to get the permissions layer involved to make decisions. Does it make sense for you to develop on this?

### 👀 Have you spent some time to check if this feature request has been raised before?

- [X] I checked and didn't find similar issue

### 🏢 Have you read the Code of Conduct?

- [X] I have read the [Code of Conduct](https://github.com/backstage/backstage/blob/master/CODE_OF_CONDUCT.md)

### Are you willing to submit PR?

No, but I'm happy to collaborate on a PR with someone else

Start in plugins/catalog-backend/src/service/createRouter.ts around line 126 and trace the existing backend filtering for relation fields and targetRef references. Review how the Permission Framework makes decisions for entity visibility. Done means related entities with restricted access are not exposed through the Inspect entity popup, including nested relation data, with the behavior covered by appropriate tests.

Written by the indexing model from the issue text.