XML-RPC object representations don't respect permissions

[dataflake]

XML-RPC requests that don't correspond to specific methods will fall back to generating a simple XML representation of the object being accessed. If the object has attributes that are themselves instances, the code will continue recursing and will generate representations for them as well.

The security checks performed in this recursive function are too simplistic. It will only exclude any attributes starting with the underscore _. It will not attempt to look up and check Zope permission assertions on the instances it finds during recursion. So if you have a folder that is accessible to a user and that folder contains items that are not, those items will still be included in the XML output.

[dataflake]

Fixed by #955 on the 4.x branch and 9191091 on master