Apply field permissions to query aliases and goal aggregates

Field permissions now apply to query aliases and aggregate functions, closing permission bypass paths.