Ensure restricted resources are not represented in vector tiles or the geojson api endpoint

[chiatt]

For the creation of map vector tiles, we filter the tiles by resources that are restricted to the user based on the no_access permission. This works for default allow, but would have no effect for default deny. Users should only see instances in vector tiles that they are permitted to read.

The same issue is true for the geojson api endpoint.