user permissions do not include inherited group permissions

[https-richardy]

When resolving a user's permissions in the GET /users/{id}/permissions endpoint, the system does not properly merge the permissions assigned directly to the user with the permissions inherited from the user's groups.