rework heatmap permissions

[noerw]

• heatmap now uses the same permission model as the activity feed:
  only include activities in repos, that the doer has access to.
  this might be somewhat slower.
• also improves handling of user.KeepActivityPrivate (still show the heatmap to self & admins)

fixes #14066, fixes #14086

[codecov-io]

Codecov Report

Merging #14080 (dc5c959) into master (e8a354f) will increase coverage by 0.02%.
The diff coverage is 78.18%.

@@            Coverage Diff             @@
##           master   #14080      +/-   ##
==========================================
+ Coverage   42.32%   42.35%   +0.02%     
==========================================
  Files         726      726              
  Lines       77689    77709      +20     
==========================================
+ Hits        32884    32913      +29     
+ Misses      39405    39401       -4     
+ Partials     5400     5395       -5     

Impacted Files	Coverage Δ
models/action.go	52.90% <71.42%> (+2.90%)	⬆️
models/user_heatmap.go	78.78% <88.23%> (-1.99%)	⬇️
routers/api/v1/user/user.go	50.00% <100.00%> (ø)
routers/user/home.go	60.67% <100.00%> (ø)
routers/user/profile.go	48.00% <100.00%> (ø)
modules/queue/workerpool.go	58.77% <0.00%> (-2.05%)	⬇️
services/pull/pull.go	41.37% <0.00%> (ø)
routers/api/v1/repo/pull.go	25.45% <0.00%> (+0.60%)	⬆️
modules/git/batch_reader_nogogit.go	46.26% <0.00%> (+1.49%)	⬆️
modules/log/file.go	75.20% <0.00%> (+1.60%)	⬆️
... and 3 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e8a354f...dc5c959. Read the comment docs.

[6543]

🚀