Specify Instance even for RT::System groups

This allows more specific indexes to be used.
->id can be called as a class method on RT::System; use eval rather than ref() and can()

This mirrors the code in RT::Principal::_HasRoleRightQuery.
Refactor duplicated role group code