Restrict ability to see user lists

## Expected Behavior
Restrict the ability to see other users in a Graylog instance.

## Current Behavior
In various places, where there are recipients for notifications or the ability to share search components, we show the full list of users to any user.
This can leak information in scenarios where Graylog is used for multiple disconnected tenants.

## Possible Solution
* globally disable per-user sharing
* or make per-user sharing a permission only assigned to specific people (or admins)

## Steps to Reproduce (for bugs)
* Create a saved search
* Open share dialog
* "Share with users" displays all users of the system

## Your Environment
* Graylog Version: 3.2/3.3