Enforce filter-expression permission by default in v2.17

[julianbrost]

This is a followup change for #10909, which was included in the v2.16.2, v2.15.4, and v2.14.9 releases and adds a new filter-expression permission to Icinga 2. As that's an incompatible change, this permission is not enforced by default yet (users need to opt-in), but the documentation and log messages already announce that this will change in v2.17.

This PR now adds exactly those changes: it changes the default of the (also newly added in #10909) enforce_filter_expression_permission config option to true and marks it as deprecated so that users are disencouraged from disabling it, but rather add the filter-expression to ApiUser objects instead. The documentation is also updated accordingly.

TODO

• Check if Icinga DB Web (or possibly other consumers of the Icinga 2 API) make use of filter expression. If so, their documentation for creating the ApiUser might need an update and we should mention it in the Icinga 2 upgrading documentation as well.

[julianbrost]

I wouldn't want to merge this just yet, see the TODO I added in the description (tl;dr: checking effects of the change on Icinga 2 API consumers like Icinga DB).

[Al2Klimov]

That's not how Icinga DB web filters objects:

https://github.com/Icinga/icingadb-web/blob/b7da98fa3adac427436152654b936612caf9ae4e/library/Icingadb/Command/Renderer/IcingaApiCommandRenderer.php#L79-L81