Don't permit user.index_all by default

Showing user.index_all has the unintended side effect of leaking
information about hidden instances. Furthermore the URL isn't exposed
through the UI anyway.
Fixup: restrict user.index_all to global admins by default

Using moderator or instance admin doesn't make any sense in most setups.
Add User.get_instances allowing to also query for hidden instances
Put hidden instance memberships in solr

e7eccbe0c177ae5ad1447178e7e3f04f3ba9a1d3 excluded hidden instances from
user.instances. This has the unintended side effect that memberships in
hidden instances aren't put in solr anymore with the effect that hidden
instance's member lists are empty. This is now mitigated (the original
intention of not showing hidden instances in other cases where
user.instances is called is still fulfilled).

A negative consequence is that hidden instances are now visible again in
user.index_all, which is why this is hidden from all but global admins
in 02a39aa8ca4455b4d9efd7a94dacb699881b1fe2.
List correct membership information in user profile in hidden instance

Note that the instance selector on that page is still kind of broken in
that case - it just shows user.instances without the hidden instance
we're currently in. But this doesn't really matter.
Merge branch 'develop' into geo