Hide PII from external reviewers, along with private reviews (#4018)

Fixes #3240. 

Adds `HIDE_IDENTITY_FROM_REVIEWERS`config option to hide
the identities of staff & applicants from external reviewers. This also
hides reviews that don't have visibility set to `reviewer` from the
sidebar as that seemed ore intuitive.

There is also a fix here for the `Updated` field of the application
where the original author will always be specified as the application
editor even if someone else updated it. This is an edge case but will be
helpful as we implement things like #3919.