[FIX] expression: use sub-select when searching on many2many field

Avoid pathological performance issue caused by injecting ids retrieved with
another query.

Consider a domain like `[('m2m', 'in', ids)]` on a many2many field.  The
current implementation will perform the subquery:

    SELECT m2m_id1 FROM m2m_table WHERE m2m_id2 IN (ids)

and inject its result into the main query as:

    SELECT id FROM ... WHERE id IN (result_ids)

The latter may be very slow if `result_ids` is a huge list of ids.

The fix injects the first query into the main query as:

    SELECT id FROM ... WHERE id IN (
        SELECT m2m_id1 FROM m2m_table WHERE m2m_id2 IN (ids)
    )

As a result, the database will typically JOIN both tables, and avoid generating
the whole list from the subquery.