Fix/scope user visibility

Fixes the problems described here: https://www.openproject.org/issues/2617 by allowing principals to be scoped by visibility, which, as of now, means shared membership in a project or being admin.

Ain't got no specs for the controller at the moment.