Performance/castle gates with join

The subselect is faster if you enumerate all castles one has access to.
However since we changed the UI to not list ALL groups or ALL users anymore but
only allow search the set of castles will always be limited.
In this case the join performs a LOT better. In particular it's performance
improves if the conditions become more strict, while the subqueries performance
becomes worse.