The previous API included a facility to filter a list of users
to include only those who are allowed to access an activity, i.e.
only people who belong to the required groups etc.

This change adds a new API function to return SQL that obtains
this list of users, so that it can be combined with other
queries.