cluster_qs_for_user: Add kwargs groups and readonly

Now checks group permissions and includes readonly clusters by default. This
can be overridden using the new kwargs.

refs #12981
Add tests for cluster_qs_for_user

refs #12981