list_editable should respect per-object permissions

[Jeremy Dunck]

Currently, list_editable for admin displays form fields for all objects, even if an auth backend supports per-object permissions.

This allows editing of objects even if the user shouldn't be able to.

If there's a backend that supports per-object permissions, only those rows which allow editing should have edit fields.

I think this means that FormSet created in changelist_view needs to be passed a result_list which is annotated with per-object permission flags, and modelform_factory should respect those flags.

[Julien Phalip]

Yes, this makes a lot of sense. The trick will be to annotate the result list in a way that doesn't impact performance too much.

[Aymeric Augustin]

Change UI/UX from NULL to False.

[Aymeric Augustin]

Change Easy pickings from NULL to False.

[Artyom Kotovskiy]

PR for this -> ​https://github.com/django/django/pull/19743

[Jacob Walls]

Would be good to have merge conflicts fixed before re-review.

[Jacob Walls <jacobtylerwalls@…>]

In 512e348b:

Refs #15759 -- Factored out _save_formset() in ModelAdmin.

[Jacob Walls <jacobtylerwalls@…>]

In 84db026:

Fixed #15759 -- Excluded fields by per-object permissions for ModelAdmin.list_editable.

Instead of going over all objects in a queryset and filtering
by user permissions, added skipping while saving the formset
so there is no need to refetch objects again.