work around accumulating select values

when applying with_access to an association the select values of that
association and the DESTINCT from with_access will be combined into an
invalid query.

I tried to work around this by using only_select inside the definition
of with_access. However with_access is (and needs to be) a scope so it
will get applied in addition to the existing scope which still includes
the select_value. In the relation merge the select values will be joined
again.

So instead we now ensure there is only the DISTINCT select in a custom
method for the group.users association. It seems like this is the only
association with_access is applied to.