Finish up the first version of the dpa_get_leaderboard() function

This commit adds caching, better documentation, sanitisation, and a
return filter.

Notably, the subquery has been split out into its own. While it was
pretty performant, we get extra performance at scale for caching this
data separately. Also has small benefits for the SQL query cache as the
function's parameters won't change this part of the call.

The second consideration is that, by default, the GROUP_CONCAT function
in MySQL limits operations to 1024 characters. This either means a
maximum of many users if the IDs are low, but if the IDs are high (=
more characters), less users would be queried.