Fix incorrect order of auth and alias filtering
Fix incorrect order of auth and alias filtering

The logic used by `annotator.annotation.Annotation._build_query`
to expand the search to include document aliases and to limit the
search by authorization were inverted. The former assumed a
structure only present when the latter was active via the `AUTHZ_ON`
application setting.

This problem could cause information leakage. No release tags include
this problem.

ningyifan/annotator-store,nobita-isc/annotator-store,nobita-isc/annotator-store,nobita-isc/annotator-store,happybelly/annotator-store,nobita-isc/annotator-store,openannotation/annotator-store