Resolve "Can add an existing group member into a group project with new permissions but permissions are not overridden"

What does this MR do?

Restricts membership in subgroups and projects to be at least that of the root group

What doesn't it do?

• I didn't add a migration to change the current behaviour - https://gitlab.com/gitlab-org/gitlab-ce/issues/51101#note_118956800
• I didn't handle the case where a member is added to a project with say level GUEST, then added to the group with level DEVELOPER - https://gitlab.com/gitlab-org/gitlab-ce/issues/51101#note_120439128

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Documentation created/updated
• Tests added for this feature/bug
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• Conforms to the style guides
• Conforms to the database guides
• Link to e2e tests MR added if this MR has Requires e2e tests label. See the Test Planning Process.

Closes #51101 (closed)