objects::ls will now check that the calling user is allowed to read the
 attributes used in the filter.
This will avoid information leak through webservice or custom filter.

issue #5732