Separate permissions for aggregation queries

### Is your proposal related to a problem?

I have what I think is a common use case that aggrgation queries can have different permissions than normal queries.

For example, users can vote on something. Only the user himself should be allowed to query a single vote, but everyone should be allowed to query the aggregated result of all votes.

Currently, for one role on one entity you can only define general permissions for "select" and additionally enable aggregation queries, but no separate permissions for aggregation queries.

### Describe the solution you'd like

Separate permissions for aggregation queries.

### Describe alternatives you've considered

No idea.

### If the feature is approved, would you be willing to submit a PR?

Unfortunately, beyond my resources.

The issue describes aggregation queries and the existing select permission model, but names no files, tests, or entry points. Start by locating how role permissions distinguish normal and aggregation queries; done means a role can restrict single-record queries while allowing the requested aggregate result, with coverage for the voting example.

Written by the indexing model from the issue text.