Protected branch merge access levels don't work with inherited access via groups

ZD: https://gitlab.zendesk.com/agent/tickets/119125

To reproduce:

  1. Create a group hello.
  2. Add a myuser user as an Owner to hello.
  3. Create a subgroup hello/mergers.
  4. Create a project hello/test.
  5. Inside the project Settings->Members for hello/test, invite hello/mergers.
  6. Inside the project Settings->Repository, create a protected branch rule with hello/mergers allowed to merge and No one for allowed to push.

For this user, the Merge button is not available because this line in https://gitlab.com/gitlab-org/gitlab-ee/blob/4d336ab526e4dcbd4b9a0263c6e33aaa81e8688a/ee/app/models/concerns/ee/protected_ref_access.rb#L75 expects the user to be a member of that group, but myuser isn't a direct member.

I think we can omit that line entirely because check_access checks the max team access level, so members don't need to be a direct member to have access. I think we need to check parent groups.

This line has been there since 2016, so I suspect this predated subgroups and protected branch group permissions.

Relevant MR: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/5103

Edited by Stan Hu