project: create exclusive sets of users based on descending "power"

Prior versions of the app tracked "seen" users in the
keystone.project_users_by_role function. This served functionally the
same purpose, but also involved iteration order magic and non-obvious
intent. This new implementation makes the ordering and reasoning more
explicit.

Bug: T330759