Hide private repos in ssh too
    
    '@all' shouldn't have access to private repos, otherwise every user sees
    all private repositories.
    
    Add the corresponding unit-tests
    
    This commit fixes CVE-2017-1002151
    Merges https://pagure.io/pagure/pull-request/2426