Instructors can add any eligible user role to a course via the Instructors sidebar in the block editor

### Reproduction Steps

+ Log in as an instructor
+ Navigate to a course or membership that you have access to
+ Use the instructor's section of the block editor plugin sidebar
+ Search for an admin or an instructor or any other role

### Expected Behavior

+ You should only be able to add their assistants to the course

### Actual Behavior

+ You can add any user (reduced to admin, manager, instructors, instructor's assistant) to the course.

### Notes

I don't think this is a terribly large issue. Instructors *can* view other instructors/assistants via the admin panel under Users. So showing the results in search doesn't pose a terrible data leak. Someone might not want them to know who the lms managers or admins are but it's not a huge issue, I don't think.

Additionally, if they *add* someone else that they shouldn't be able to add the simple solution is to just remove them and moderate.

But we should fix this anyway.

I believe we'll need to modify the existing user search component to utilize the users rest api "include" endpoint so that the only users included in the search result are users available to the current user.

Maybe we can filter the rest input arguments (or filter results) for an instructor user.