Release v2.2.0

Changed

• A read model that no declared query returns now renders as requiring an authenticated caller, and reports it as a diagnostic, rather than being left open to everyone. A slice that declares no query at all is unchanged and still renders as [AllowAnonymous].

Security

• A read model is now guarded by the authorization declared by the queries that read it, instead of by every query in its slice. A slice declaring several read models rendered each of them with the union of all their queries' authorization, so a single unguarded query on one read model rendered the others as [AllowAnonymous] — the rendered application was more permissive than the document it came from.