Reimplement portrait retrieval around the user_portrait relationship, as procs such as merge::MergeUserInfo do not assume a certain name format on the cr_item
Redefine acs_group__member_p so that direct membership is checked in a way that is uniform with that of cascading membership: without any permission check (fixes acs_subsite_check_composite_group automated test)