Scope read access to the referenced document

Decoupled comment permissions from document access, allowing apps to restrict comment visibility (e.g. internal notes on support tickets) without overriding endpoints.