ActivityPub Controller: Change how hiding follows/followers is represented

1. If the request is authenticated and the user making it == the user whose follows/followers are being rendered, render the followers even if hide_followers/hide_follows is set, this is useful for AP C2S
2. If hide_followers/hide_follows is set, first will just be the URI to the first page, instead of the page itself.
3. When pages are requested and hide_followers/hide_follows is set and the user making it != the user whose follows/followers are being rendered, return a 403 error. This is what Mastodon does as well and it will allow us to correctly detect hide_followers/hide_follows for remote users (I intend to do it in a separate MR)