Hide API-only app permissions on users page

Joseph spotted that I missed this in #2452. Now fixed!

app/models/users_filter.rb

@@ -60,7 +60,7 @@ def role_option_select_options(aria_controls_id: nil)
   end
 
   def permission_option_select_options(aria_controls_id: nil)
-    Doorkeeper::Application.includes(:supported_permissions).flat_map do |application|
+    Doorkeeper::Application.not_api_only.includes(:supported_permissions).flat_map do |application|
       application.supported_permissions.map do |permission|
         {
           label: "#{application.name} #{permission.name}",

test/models/users_filter_test.rb

@@ -256,6 +256,20 @@ class UsersFilterTest < ActiveSupport::TestCase
         assert_not app2_option
       end
     end
+
+    context "when App 2 is API-only" do
+      setup do
+        @app2.update!(api_only: true)
+      end
+
+      should "return not include options for API-only application permissions" do
+        filter = UsersFilter.new(User.all, @current_user, {})
+        options = filter.permission_option_select_options
+
+        app2_option = options.detect { |o| o[:value] == @app2.signin_permission.to_param }
+        assert_not app2_option
+      end
+    end
   end
 
   context "when filtering by organisation" do