Restrict assignment of alerts to only those with permission to see them

Summary

Alerts can be assigned to users who do not have permission to see them. The autocomplete list in the UI for alerts includes all users, not just those who can see the project, and specifically, alerts.

We should only allow alerts to be assigned to users who can read_alert_management_alerts, and the assignee dropdown should only should viable candidates.