BUG: Custom Results REST API endpoints have no permissions check

[JakePT]

Describe the bug
The Custom Results admin page is powered by two REST API endpoints, pointer_search and pointer_preview. These are used for finding posts when displaying the default search results and when searching for new posts to add. Both of these endpoints have no permissions check even though they're only used in the admin.

They likely lack a permissions check because all they are doing is performing a WP_Query search on public content, but restricted or protected content could still be included if these endpoints were not properly accounted for when restricting content. I'm aware of at least one site where this has been an issue.

Steps to Reproduce

1. While signed out, access the /wp-json/elasticpress/v1/pointer_search and /wp-json/elasticpress/v1/pointer_search endpoints.
2. They will return a successful response even if not signed in.

Expected behavior
Ideally these endpoints should require the same permissions as the Custom Results admin screen so that they are not exposed publicly.

Additional context
Props @PypWalters