IdStory Identity Manager

When we use the default settings of managers and subordinates by tree structures (https://wiki.czechidm.com/devel/documentation/architecture/dev/filters#defaultmanagersfilter), the managers are not able to see their inactive subordinates.
If we use finding managers/subordinates by directly configured managers (https://wiki.czechidm.com/devel/documentation/architecture/dev/filters#guaranteesubordinatesfilter), then managers can see the identities in the list of users, but aren't able to open them.

• make the default behavior of different algorithms consistent
• allow us to configure (without implementation) per project, if the managers may see/edit their left subordinate, or not (we need both options for different customers)

• create manager and their subordinate, deactivate the subordinate by their contract's valid till
  
• login as manager -> Users -> clear the filter. You cannot see the inactive subordinate at all:
  
• use the direct managers configuration:
  idm.sec.core.filter.IdmIdentity.managersFor.impl=guaranteeManagersFilter
  idm.sec.core.filter.IdmIdentity.subordinatesFor.impl=guaranteeSubordinatesFilter
• login as manager -> Users -> clear the filter. You can see the inactive subordinate:
  
• try to open the inactive subordinate => insufficient access rights
  

Note: userRole contains userManagerRole, no other changes in default permissions were made