Reject invalid approvers when creating Approval Rules from codeowners

#220054 (comment 355795190)

[W]e are filtering the users (and group members) in ApprovalRules::ParamsFilteringService and ApprovalRules::CreateService/ApprovalRules::UpdateService (via ApprovalRules::Updater concern). It seems that MergeRequests::SyncCodeOwnerApprovalRules doesn't filter it that's why it's being returned in the response.

"Quick" fix for that is to filter the users (and group members) when syncing code owner rules. But I also think we need to refactor that filtering logic so it's reusable.