Make chain filters viewable when collection permissions allow it (#28581)

* Adds tests for chain filters security issue

* add another test

* Users with collection permissions can view chained filters for dashboard

- this obeys sandboxing

* Users with collection access should be allowed to view chain filters

* add test + fix case for block filters

* check with premium features

* check premium features + revert with-premium-features in tests

* remove block check

* respond to review comments

* ensure data-perms are there + check blocked

* rewrite e2e test so that it actually tests chain filters

* properly toggle linked filters on

- don't use random classes, etc

* rename *param-values-query* dynamic var

* update chain-filter docstring

* token-features should still be private