com_resources: restrict /api/resources/list to the caller's access level

[denphi]

listTask filtered on standalone, published and the publish window only, so GET /api/resources/list returned registered-, protected- and private-level entries to anonymous callers, including their titles, introtext and fulltxt.

Apply the same rule the site views use: public for everyone, plus registered-level once authenticated. Component administrators keep the unrestricted view, so the admin searchable path in v1.1 is unaffected.

Two related fixes in the same task:

• type is documented as a type name but was compared straight against the numeric column, so only ids ever matched and an alias silently returned everything. Resolve an alias to its id, and let an unknown alias match nothing.

• v1.1 referenced Config:: and User:: without importing them. Inside namespace Components\Resources\Api\Controllers those resolve to classes in that namespace, so the first call would throw "class not found". v1.0 already used a leading backslash for Config.

Before you submit this pull request, please make sure:

• [] Make sure there are links in the PR to the source JIRA card(s) and hubzero ticket(s)
• [] Include a brief summary of the issue in your own words
• [] Include a brief summary of the fix/changed code
• [] Include a brief summary of your testing. What did you specifically do to investigate that this change has the correct results?
• [] Indicate if the change needs to be hotfixed to any production hubs before a normal core rollout
• [] Double check someone is assigned to review the ticket

Thanks!