Expose a permission to control access

The view currently controls access via the "view published content" permission - not a security issue at present as only published nodes are exposed, but the module should define its own permission and use that for access control.

This will be important for #2399253: Expose filters