Add capability check to Custom Results API endpoints.

[JakePT]

Description of the Change

Adds a capability check to Custom Results API endpoints used for editing results sets. While those endpoints only return content that's normally publicly accessible the endpoints could inadvertently expose protected content that was not adequately protected. Since the endpoints do not need to be publicly available they can be restricted by the same capability required for accessing the admin page.

Closes #3001

How to test the Change

1. Accessing /wp-json/elasticpress/v1/pointer_search?s=abc in the browser should return a 401.
2. The search fields when creating a custom results set should function as normal.

Changelog Entry

Changed - The endpoints used for managing custom results are no longer publicly accessible.

Credits

Props @JakePT , @PypWalters

Checklist:

• I agree to follow this project's Code of Conduct.
• I have updated the documentation accordingly.
• I have added tests to cover my change.
• All new and existing tests pass.