[SECURITY] Respect permissions of storages in a file collection

If a user creates a sys_file_collection record, only those
storage records must be shown which are allowed for the
user.

Resolves: #82029
Releases: master, 8.7, 7.6
Security-Commit: 45cdfccd52a224d8128e537214606848c717d8e7
Security-Bulletin: TYPO3-CORE-SA-2017-005
Change-Id: Iee94cd84f07ee0dc0730fe1ce84d228dad2f75a2
Reviewed-on: https://review.typo3.org/53902


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>