Returns the users this caller is allowed to impersonate, filtered by searchText. Used by admins to pick a target user before starting an impersonation session. The list is empty when the caller is already impersonating another user — you can't chain impersonations from within an active session.