make WorkPackage.count_and_group_by private

WorkPackage.count_and_group_by is a WorkPackage internal method
and it is currently only used as an internal method.
It allows SQL injection when the parameters come from user input, but
every known call serves safe constants as parameters to this method.

Anyways, we're better "safe" than sorry and make this method private.

[``* `#5590` Evaluate known security risks``](https://www.openproject.org/work_packages/5590)