Require a viewer to load handles

Summary:
Unmuck almost all of the we-sort-of-have-viewers-some-of-the-time mess.

There are a few notable cases here:

• I used Omnipotent users when indexing objects for search. I think this is correct; we do policy filtering when showing results.
• I cheated in a bad way in the Remarkup object rule, but fixing this requires fixing all the PhabricatorRemarkupEngine callsites (there are 85). I'll do that in the next diff.
• I cheated in a few random places, like when sending mail about package edits. These aren't a big deal.

Test Plan:

• Grepped for all PhabricatorObjectHandleData references.
• Gave them viewers.

Reviewers: vrana

Reviewed By: vrana

CC: aran, edward

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D5151