We have clients who have high security needs and want to lock things down really tightly.

One identified user risk is stopping users, or those in a role, from search for other users. This is leaking through the message interface. There doesn't appear to be a single capability for this, it seems broken up into a few other caps and none are quite up to the task. So I'm proposing to introduce a new cap which would be checked as well as the existing caps for different use cases so it's easy to lock it down everywhere.

A new capability called “moodle/site:lookupuser” is added to restrict searching for non-contact user

Expected behavior

 The user without moodle/site:lookupuser capability:

 - Will be able to search users who are already in their contact list

 - Will not be able to search users who are not in their contact list

User with moodle/site:lookupuser capability will be able to search users in contact, non-contact list.