fix(plugin-security,spec): explain decides whether a record story discloses a record by the asker's read, not the explained principal's

fix(plugin-security,spec): explain decides whether a record story discloses a record by the asker's read, not the explained principal's #44612