Skin resources are evaluated with the rights of the current document

The skin action currently evaluates parsable resources (.css, .js and, for filesystem, .less files) using the current document as security document. This means that if the current document has PR (like most standard XE xar documents are), the skin resource will be executed with PR.

On the flipside, this also means that filesystem resources that get resolved to having XWikiGuest (null) as their contentAuthor will never have the Script Rights to evaluate a velocity code that ends up rendering a script (velocity, etc) macro from inside a wiki page for instance.

This is currently affecting (at least) searchSuggest.js right now and the result is that the list of suggestion sources is not populated.

The idea is to be consistent with what we do for skin templates (e.g. XWIKI-11202) where if the template is overridden in a skin document (as object or attachment), the skin document's last author is used when checking Script/Programming Rights.

For skin resources coming directly from the filesystem, the superadmin user should be used for checking rights, since their author can not be verified but the security should be more or less guaranteed by the fact that they are located on the filesystem and not on the wiki.