[rset] do not filter rsets with __getstate__, ensure whatever flies with pyro has no .req attribute, also set the ._rqlst to None since it will be reconstructed later on demand

[security] SchemaRelation.has_perm grows to new arguments allowing to specify subject/object entity type when actual eid are not known, but their types are

[linkto action] refactor to ease overriding to control redirection