perf: use single database query for members_min|max_privacy_level

These functions are used a lot, especially in recruitment - a study is not
a fit if no one in the study has the required privacy level.

They are slow because they make heavy use of the pluggable permissions
system. First, to get tehe relevant users, and then to check their
privacy levels.

This optimization is possible because (1) the privacy level is not a
model field and (2) becuase I no longer filter for relevant users.