Add missing permission checks to wiki endpoints

Adds read checks to change request diffs, listings, breadcrumbs and the space route list, requires Approved status to retry a merge, and limits external links to http, https and mailto.