Move this code into a function, or possibly a class, so that it can be shared, but customised to particular circumstances.

Make the search ajax-y when JavaScript is available. In this case:
* No need to click OK to trigger a search.
* With more than MAX_USERS_PER_PAGE we don't display them. When there are fewer, we stop doing a server round-trip for the searches and reduce the timeout.
* If some users are already selected, and you change the search term, then those users stay selected, possibly being moved to a separate optgroup.
* If what you have typed uniquely identifies one user, that option is automatically selected.

This sort of control will also be needed on the explain permissions page (MDL-16964), and in the user's roles report (MDL-11186). MDL-16418 is a subset of this.