A group managed account should only be able to create private projects

Overview

While we'll restrict work in a group using group managed accounts to users mapped to that group, we don't restrict any behavior on the user's side.

Proposal

To limit the number of accidental project issues, any user mapped to a group using group managed accounts should not be able to create a public or internal project.

This would also require the group using group managed accounts enforcement to be private.