Delete has_permission filter sites in the variants router

[bencap]

Five loop-body read filters in routers/variants.py, all of the form has_permission(user_data, variant.score_set, Action.READ):

Line	Context
99	single-variant lookup
211, 225	ClinGen allele search
408, 422	ClinGen allele search, second pass

The router filters after the query, so counts and pagination are already incorrect. The allele-search sites return variants from arbitrary score sets, so assert_permission at the router boundary never covered them — there is no parent entity to guard.

Scope

Delete all five. RLS on scoresets covers them: a variant whose score set is invisible cannot be reached through the join.

Where a filter relied on implicit lazy traversal of Variant.score_set, add an explicit eager load so the loading decision is deliberate rather than incidental.

Do not begin until the policy-gap counter in #835 has read zero for a full release cycle.

Acceptance criteria

• All five filter calls removed.
• Test: ClinGen allele search as an unentitled persona returns no variants from a private score set.
• Test: the same search as the score set's owner does return them, guarding against over-filtering.
• Counts and pagination reflect the filtered set.
• No behavior change for entitled callers.