This is to let us redact them later in another filter.

And make it more generalized for all filter specs.

For simplicity's sake, since we're testing the actual referencing, we
just force the permission check to always be allowed.

Commit ranges, commits, external issues, issues, labels, merge requests,
snippets, users.