Hide system document from /data queries

The system document may contain an authorization policy for OPA
itself--the authorization policy will depend on the input docoument
which would prevent users from querying for /data without providing a
value for the input document.

In the future /data/system may be used for other purposes, e.g., debug
info, module source file storage, etc.