The `Sql::columns()` method doesn't override existing columns when calling this directly, because
at this point the ipl/orm query has already collected all selectable columns, which are not required
for this use case. A later call to the `columns()` method using the select base doesn't prevent all the
columns registered by the query from being selected.
`grantsOnType()` will now perform the permission check it is asked for
on every object that matches the filter. It will then cache all
individual results so that any subsequent call to `grantsOn()` will
hit the cache instead of triggering another query.
