Parenthesize subqueries in rendered permission conditions

Permission criterion subqueries are now properly parenthesized, fixing Company Restriction queries on all databases.