Avoid a SQL union in users.utils.filter_rights

arkindex.users.utils.filter_rights handles the public attribute on models that have it by using a UNION, which prevents most users of this function from applying any extra filters, ordering, annotations, etc. and usually require them to recreate querysets that can be much less optimized or require some hacks: ListCorpus loads all corpora twice to be able to get the rights level. ListModels might generate up to 20 SQL queries per page to fetch all rights too, since the workaround ListCorpus uses does not work with pagination (!1663 (merged)).

When we implemented generic rights, we were using Django 3.1, and support for nested filtering in a FilteredRelation was added in Django 3.2; we might have better luck with it now to use it in a queryset without a union.