using AND filter to always restrict the request to the scope defined in config

In this MR the filtering is upgraded so that the config.accession.filter is always applied. That's done by using filter's AND option: { ..., "AND": config.accession.filter }.

API does not handle AND properly -- needs genesys-pgr/application-blocks!124

Other parts of the app need to be revised so that the same logic is applied.