accesslib: get_user_by_capability() - Handle complex rolecap resolution

accesslib: get_user_by_capability() - Handle complex rolecap resolution

With this patch, get_user_by_capability() can handle the cases where
users have multiple role assignments to the same course, and PREVENTs
and PROHIBITs affect the rolecaps of this course.

Without stored procedures we cannot resolve this entirely on the
server side - so in the complex cases we do as much as we can on SQL,
and post-process the data on the PHP side, including SQL-style
pagination.

MDL-12452