Changes look perfect, just wanted to comment here some details, for clarification and fixing:
1) With the change of get_with_capability_join() we are adding a new "any" (logical OR) behavior to the function that is not documented anywhere. IMO it's a must to clearly document (phpdoc + upgrade.txt) that change in param and behavior.
2) Same applies to functions calling it. In fact, within the patch are uses that have switched from string to array without any advise. Both get_with_capability_sql() and get_enrolled_with_capabilities_join() now support arrays (in fact the patch is using them). So it must be documented there too (both the param and the logical OR behavior). Side comment: Hope we won't end needing "all" (logical AND) alternatives for those functions, time will tell.
3) Unless I'm getting it wrong, the changes in the issue are, effectively, changing public api. Both quiz_attempts_report_table, some global functions like quiz_report_grade_bands() and also some "internal" (protected), but potentially callable by extended subclasses, now require different parameters. How will that affect 3rd part quiz reports out there? If there are implications, they also need to be documented. NP if not.
4) This comment in the upgrade.txt notes worries me a little bit:
+For sites upgrading please note that the quiz statistics report will fail
+on fist viewing unless you carry out a regrading. This is because the hash
+changes with this code, and the regrading process creates a fresh hash.
Which is the exact impact people will face? Which are the results, in practice, of such a "fail on first viewing" ? I've tried here with 2-3 quizzes and have not noticed anything with/without regrading, but maybe that's because I'm not fulfilling some requirement. My point is that, if we know in advance that something is going to fail, instead of allowing that we should, somehow "reset" or "flag" or "upgrade" or whatever is needed to avoid any of those "failures" to happen (again, without knowing what the real meaning/impact of those "fails on first viewing"). Please clarify.