[ebariaux]

Description

This PR ensures rules retrieve users within their engine scope while preserving caller-supplied filters and keeping reusable queries isolated between executions.

• Enforce the engine’s realm for asset-scoped user queries, alongside the existing asset-subtree restriction.
• Preserve caller attribute filters when excluding system accounts.
• Combine service-account filtering with username predicates using AND, preventing username filters from bypassing account restrictions or returning unrelated users.
• Copy queries and nested predicates before execution, preventing accumulated restrictions and scope leakage between executions.
• Preserve empty asset selections so they return no users.

Compatibility and release notes

There are no API signature changes, but query results can change for rules or applications relying on the previous incorrect filtering. It's worth adding the below paragraph in the release notes.

User queries now enforce account-type and username filters together. Rules also preserve caller-supplied attribute filters, and asset-scoped rules only retrieve users from their own realm who are linked within the scoped asset subtree. Existing rules and notification recipient selections may consequently return fewer users. Review configurations that relied on previously ignored filters or cross-realm user links.

Part of the rules facade scoping review tracked in #2675.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[wborn]

LGTM! 👍