Allow RT::Users->WhoBelongToGroups to optionally return unprivileged users

The WhoBelongToGroups filter should really not apply LimitToPrivileged at
all, but we can't remove it without breaking security assumptions elsewhere
in RT or in 3rd party code. So a new option IncludeUnprivileged is added, a
boolean that defaults to false. It can be set to true to disable the
LimitToPrivileged filter.

The documentation of the method is amended to explain that it filters out
unprivileged members by default.
Merge branch '4.0/whobelongtogroups-unpriv' into 4.0-trunk