Grades for flows viewable even when not shown in gradebook

Removing a grading opportunity from the student gradebook does not prevent students from viewing their grades by going directly to the homework flow. Changing flow permissions should provide a workaround, but I guess automating this somehow would be nice.

Start by reproducing the reported path: hide a grading opportunity from the student gradebook, then open the homework flow directly and inspect the flow-permission behavior. Define the intended access rule and add coverage showing that a hidden grade is not viewable through the direct flow.

Written by the indexing model from the issue text.