exclude subjects from recruitment if no study members can access them

Related to !2393 (merged): Better then allowing to remove subjects with too high a privacy level from recruitment is to not add them in the first place.

I am not sure hot to get the maximum privacy level yet. I can think of several options:

1. let study managers provide a maximum privacy level explicitly
   1. default to 0 -> additional work for study managers
      1. without further explanation
      2. display a warning in the filter UI if the default has not been changed
   2. default to 2 -> no one will ever change that setting, nothing gained
2. derive maximum privacy level from recruiters/conductors, use default value when no recruiters/conductors are added yet
   1. default to 0 -> the preview numbers in the filter UI could be significantly off if no recruiters/conductors have been added yet
      1. without further explanation
      2. display a warning in the filter UI if no recruiters/conductors have been added yet
   2. default to 2 -> adding a conductor could turn already recruited subjects into non-matches
3. Do not filter by privacy level -> recruiters don't know the privacy levels of conductors

I think we can exclude 1.2 and 2.2. I am currently torn between the other options. This currently implements 2.1.2.