Change exchange ACL so non-admin user can't read nodes owned by others

[bmpotter]

A customer has raised that this is a security concern, and i tend to agree. I think the code fix for this is trivial:

• In src/main/resources/config.json in the api.acls.User array, remove READ_ALL_NODES
• There may also be existing tests that need updating
• And add a couple tests to ensure a non-admin user can't read another's node, but an admin user can

I don't think this change will have any impact on existing users or usage scenarios, but i'm not sure, and i'm concerned that the ACLs have been this way for so long that it is hard to know if anyone has been depending on it. So better to make this change soon so we have more time for ad hoc testing.

[sf2ne]

Pending a response from the UI team on if this is containable for this release

[sf2ne]

Verified on staging