Apply row and field permissions in list endpoints

Gameplan's own list endpoints apply Frappe's row and field permission checks, so each user sees the same rows and fields as the standard API.