inherit require 2fa for all subgroups and projects

What does this MR do?

Me as a group owner, I want the require 2FA property to be inherited across all my subgroups and projects. So in this MR the set of users is extended to include all users of sub-groups and projects (of the group or subgroups).

If the decision was taken, that a group needs to have two factor authentication, this indicates that high security requirements are needed. as there is the possibility to have subgroups and projects in a group, it is quite plausible that this high security requirements also apply for this subgroups and projects. So it would be much more intuitive when the 2FA requirement is propagated to the subgroups and all projects. It seems wrong that people added in subgroups or on project level do not need tho have 2FA.

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Documentation created/updated via this MR
• Documentation reviewed by technical writer or follow-up review issue created
• Tests added for this feature/bug
• Tested in all supported browsers
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• Conforms to the style guides
• Conforms to the database guides
• Link to e2e tests MR added if this MR has Requires e2e tests label. See the Test Planning Process.
• Security reports checked/validated by reviewer

The development of this MR is sponsored by @ siemens (/cc @bufferoverflow).

.gitlab/ci/frontend.gitlab-ci.yml

@@ -33,16 +33,16 @@ gitlab:assets:compile:
     DOCKER_HOST: tcp://docker:2375
   script:
     - node --version
-    - yarn install --frozen-lockfile --production --cache-folder .yarn-cache
+    - retry yarn install --frozen-lockfile --production --cache-folder .yarn-cache
     - free -m
-    - bundle exec rake gitlab:assets:compile
+    - retry bundle exec rake gitlab:assets:compile
     - time scripts/build_assets_image
     - scripts/clean-old-cached-assets
-    - rm -f /etc/apt/sources.list.d/google*.list # We don't need to update Chrome here
+    - rm -f /etc/apt/sources.list.d/google*.list  # We don't need to update Chrome here
     # Play dependent manual jobs
     - install_api_client_dependencies_with_apt
-    - play_job "review-build-cng" || true # this job might not exist so ignore the failure if it cannot be played
-    - play_job "schedule:review-build-cng" || true # this job might not exist so ignore the failure if it cannot be played
+    - play_job "review-build-cng" || true  # this job might not exist so ignore the failure if it cannot be played
+    - play_job "schedule:review-build-cng" || true  # this job might not exist so ignore the failure if it cannot be played
   artifacts:
     name: webpack-report
     expire_in: 31d
@@ -65,9 +65,9 @@ compile-assets:
   stage: prepare
   script:
     - node --version
-    - yarn install --frozen-lockfile --cache-folder .yarn-cache
+    - retry yarn install --frozen-lockfile --cache-folder .yarn-cache
     - free -m
-    - bundle exec rake gitlab:assets:compile
+    - retry bundle exec rake gitlab:assets:compile
     - scripts/clean-old-cached-assets
   variables:
     # we override the max_old_space_size to prevent OOM errors
@@ -141,8 +141,8 @@ jest:
   extends: .dedicated-no-docs-and-no-qa-pull-cache-job
   <<: *use-pg
   dependencies:
-  - compile-assets
-  - setup-test-env
+    - compile-assets
+    - setup-test-env
   script:
     - scripts/gitaly-test-spawn
     - date
@@ -154,8 +154,8 @@ jest:
     expire_in: 31d
     when: always
     paths:
-    - coverage-frontend/
-    - junit_jest.xml
+      - coverage-frontend/
+      - junit_jest.xml
     reports:
       junit: junit_jest.xml
   cache:
@@ -220,7 +220,7 @@ lint:javascript:report:
   before_script: []
   script:
     - date
-    - yarn run eslint-report || true # ignore exit code
+    - yarn run eslint-report || true  # ignore exit code
   artifacts:
     name: eslint-report
     expire_in: 31d
@@ -235,7 +235,7 @@ jsdoc:
   before_script: []
   script:
     - date
-    - yarn run jsdoc || true # ignore exit code
+    - yarn run jsdoc || true  # ignore exit code
   artifacts:
     name: jsdoc
     expire_in: 31d