Fix expansion of projects into lists of user PHIDs

Summary:
Ref T11016. I think I inverted the meaning of this function by accident in D14893.

The intent is to return a list of users: direct users, and all members of all projects.

Prior to this patch actually returns direct users, and all projects they are members of.

Test Plan:

• Created "Project with Dog".
• Added user "dog" to project.
• Created package "X", owning file "/x", with audit enabled.
• Made "X" owned by "Project with Dog".
• Modified "/x" and had user "dog" accept it.
• Landed change.
• Prior to change: package "X" incorrectly added as auditor.
• After change: package "X" correctly omitted as auditor, because a member reviewed the change.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T11016

Differential Revision: https://secure.phabricator.com/D15971