fix bug that wouldn't show posts to a user who was in an allowed group

 ...when individual contacts were also specified in the permissions.

I actually already fixed this bug in the `permissions_sql()` function, but I missed the same logic in `item_permissions_sql()` until now