clfilter: enforce hidden filtering on all repository accesses

We ensure all repositores created through `mercurial.hg.repository`
are "hidden" filtered. This is an even stronger enforcement than
5bb610f87d1d.

Citing Matt's response to changeset 5bb610f87d1d installing filtering
in dispatch:

> Unfortunately, this means that code that doesn't go through dispatch (ie all
> those crazy misguided people using Mercurial as a library) are going to see
> these hidden changesets.
>
> Might be better to instead install the filter in localrepo construction by
> default and disable it in dispatch.

mercurial/dispatch.py

@@ -710,9 +710,7 b' def _dispatch(req):'
                 repo = hg.repository(ui, path=path)
                 if not repo.local():
                     raise util.Abort(_("repository '%s' is not local") % path)
-                if not options['hidden']:
-                    repo = repo.filtered('hidden')
-                else:
+                if options['hidden']:
                     repo = repo.unfiltered()
                 repo.ui.setconfig("bundle", "mainreporoot", repo.root)
             except error.RequirementError:

mercurial/hg.py

@@ -113,7 +113,7 b" def repository(ui, path='', create=False"
     if not repo:
         raise util.Abort(_("repository '%s' is not local") %
                          (path or peer.url()))
-    return repo
+    return repo.filtered('hidden')
 
 def peer(uiorrepo, opts, path, create=False):
     '''return a repository peer for the specified path'''