Clarify use of PermissionCollection.Factory#filter.

Change-Id: I4d106a8490207aaceaa8a6d60790a55f69f34f1a

java/com/google/gerrit/server/permissions/PermissionCollection.java

@@ -61,7 +61,8 @@ public class PermissionCollection {
     }
 
     /**
-     * Get all permissions that apply to a reference.
+     * Get all permissions that apply to a reference. The user is only used for per-user ref names,
+     * so the return value may include permissions for groups the user is not part of.
      *
      * @param matcherList collection of sections that should be considered, in priority order
      *     (project specific definitions must appear before inherited ones).