[imorland]

Changes proposed in this pull request:

A post mention links to the mentioned post's discussion by slug, and the slug carries the discussion's title. Mentioned posts were looked up without a visibility scope, so on the post show, discussion show and include=mentionedBy responses a mention of a post in a discussion the viewer can't see (restricted tag, private, hidden) still carried that discussion's title in its link. The lookup is now scoped by the request's actor and mentions of posts the actor can't see render as deleted, as the post list already did. Renders without an actor, such as emails, follow core's rule for links to discussions: they only name what guests can see and link the rest by discussion ID alone.

Reviewers should focus on:

• The email behaviour: on forums guests can't read, mentions in emails now link /d/<id>/<number> instead of /d/<id>-<slug>/<number>, rather than becoming "deleted".
• LooksUpMentionedModels::mentionedModels() now also takes a closure, so the scoped query (and its permission lookup) is only built when there is something to look up; MentionRenderingQueriesTest pins that.
• An already loaded mentionsPosts relation is still trusted; every eager load in the monorepo is scoped (core's eager-load scoping, and mentionedBy's nested load now explicitly).

Necessity

• Has the problem that is being solved here been clearly explained?
• If applicable, have various options for solving this problem been considered?
• For core PRs, does this need to be in core, or could it be in an extension?
• Are we willing to maintain this for years / potentially forever?

Confirmed

• Frontend changes: tested on a local Flarum installation.
• Frontend changes: tests are green (run yarn test in js/).
• Frontend changes: tests have been added, or are not appropriate here.
• Backend changes: tests are green (run composer test).
• Backend changes: tests have been added, or are not appropriate here.
• Where applicable, changes are suitable for all supported database drivers (MySQL, MariaDB, PostgreSQL, SQLite).
• Core developer confirmed locally this works as intended.
• The description above is written by me and describes what this pull request actually does.