Get where an identity may act with one permission

Returns where the identity may act with permission, for a list query: roots, the nodes it holds the permission at that no other such node already covers, and nodes, every node beneath those roots, the roots included, when there are at most max_nodes of them (default 10,000; at most 50,000). Past the cap nodes is null and complete false, and the caller filters by roots against its own closure table or materialised path. env_wide is true when a root is the Environment's own root, so every node qualifies and no filter is needed; nodes is null then too. The same rules as evaluate decide the roots, so a list filtered by this answer agrees with the check a write makes. Returns 404 when the identity has no membership in this Environment.