Fix handling of public sessions in protected events

Currently e.g. getting timetable information or viewing a contribution requires full read access to the event, regardless of whether the user has access to the associated object.

Also, viewing a contribution requires event access, so if the contribution is public (either by inheritance or by itself), access is denied if the event itself is protected.

No file, test, or entry point is named; begin by locating the authorization checks for timetable information and contributions. Confirm how access is inherited for public associated objects, then verify that public sessions and contributions remain viewable without full read access to a protected event.

Written by the indexing model from the issue text.