user_list: Factor user list SQL preparation

get_user_data and get_number_of_users had copy-pasted code to build
basically the same query, except for COUNT() and sorting addendums.

Factor this logic to prepare_user_sql_query() which takes a $count
boolean parameter to define if it should build a COUNT query or a simple
SELECT.
user_list: Escape SQL wildcards in simple search

The "keyword" parameter was missing a ::escape_sql_wildcards call, to
filter it correctly, like the other parameters.

Refs #6735
user_list: Sanitize $_GET values for user query

Given the huge number of $_GET values used in this script, it's better
to sanitize them all together instead of duplicating function calls.