Follow-up from restricting pushes / merges by group

<moved tasks to !927 (merged)>