invites: Add defensive assert in do_get_invites_controlled_by_user.
invites: Add defensive assert in do_get_invites_controlled_by_user.

This is a follow-up to d201229df8a547e0a0d4c15baa69dc56dc7d4499.
do_get_invites_controlled_by_user queries for Confirmations when finding
multiuse invites controlled by a user. This means that a revoked
multiuse invite cannot really be fetched here, because
do_revoke_multi_use_invite deletes the Confirmation object when revoking
the invitations. However, having a defensive assert here should be
useful to make this doesn't secretly break in the future if the query
used changes or if there are unexpected revoked multiuse invites with an
existing Confirmations for any (buggy) reason.

zulip/zulip,zulip/zulip,zulip/zulip,zulip/zulip,zulip/zulip,zulip/zulip,zulip/zulip