Ref T11016. I think I inverted the meaning of this function by accident in D14893.

The intent is to return a list of users: direct users, and all members of all projects.

Prior to this patch actually returns direct users, and all projects they are members of.

• Created "Project with Dog".
• Added user "dog" to project.
• Created package "X", owning file "/x", with audit enabled.
• Made "X" owned by "Project with Dog".
• Modified "/x" and had user "dog" accept it.
• Landed change.
• Prior to change: package "X" incorrectly added as auditor.
• After change: package "X" correctly omitted as auditor, because a member reviewed the change.