fixes #6964 - replace default scope that hides users with explicit scope

My aim is to fix http://projects.theforeman.org/issues/6964, which remained after my attempt to fix a similar issue in 3dd51f407.  This latest error in 6964 is again caused by the default scope hiding users, so associations aren't resolving properly in user roles, which causes problems with role caching.

I could have continued to add workarounds to find users that aren't shown by the default scope, but decided instead to partially implement 6878 (removal of default scopes) and try to hide hidden users at the controller level instead.  It was much easier than I expected, but would appreciate any help thinking of remaining issues where hidden users might be visible when they shouldn't be.

Successfully done a test install with this patch.
nitpick: just why here except_hidden and in other places visible ?