Query issues in filter_users_with_capability_on_user_context_sql

I've identified a few problems here:

1. The first column may not be unique (rc.id can be used in more than 1 context)
2. The capability check seems to be missing
3. ctx.id contextid should be ctx.id AS contextid (I think)
4. That doesn't seem to work when a role is given in a user context
   • Create a role
   • Allow a capability just in that role (not in system)
   • Assign that role in a user
   • Confirm that the user is returned by the query