Apply a permission's filter and child_only constraints to a query. No-op when permission is nil.

Returns {:ok, permission_map} if the op is allowed, {:error, :forbidden} otherwise. Public is tried first; member fills in if public denies.