Redo include/exclude search

The include/exclude by group/tag search doesn't respect ACLs, behaves inconsistently, and in some cases is dead wrong (including contacts with tags that should be excluded). This patch reworks that search and adds a feature for including or excluding target contacts of one or more activity queries.