Fix #4867: random=true in api only returns one post.

Pundit 2.1.1 changed it so that if the first argument to `authorize` is
an Array, then the `authorize` call returns the last element of the
array. This broke order:random, because in that case we returned an
Array of posts. The fix is to return an ActiveRecord::Relation of posts,
which is more correct anyway.

app/logical/post_sets/post.rb

@@ -115,7 +115,7 @@ module PostSets
         @post_count = get_post_count
 
         if is_random?
-          get_random_posts
+          get_random_posts.paginate(page, search_count: false, limit: per_page, max_limit: max_per_page).load
         else
           normalized_query.build.paginate(page, count: post_count, search_count: !post_count.nil?, limit: per_page, max_limit: max_per_page).load
         end