Protected branches api fails to add merge and pull access at the same time

Summary

Using the api, users cannot be granted merge and pull access at the same time on a protected branch.

Steps to reproduce

• Make a new repo
• Make a new branch
• Try to protect the branch, giving yourself merge and pull rights: curl -g --request POST --header "PRIVATE-TOKEN: <your-secret-token>" 'https://gitlab.com/api/v4/projects/<your-project-id>/protected_branches?name=<branch-to-protect>&allowed_to_push[][user_id]=<your-user-id>&allowed_to_merge[][user_id]=<your-user-id>'
• Reply will be {"message":["Cannot add users or groups unless they have access to the project"]} and the branch will not be protected

However, granting only merge or only push rights does work:

1. only push: curl -g --request POST --header "PRIVATE-TOKEN: <your-secret-token>" 'https://gitlab.com/api/v4/projects/<your-project-id>/protected_branches?name=<branch-to-protect>&allowed_to_push[][user_id]=<your-user-id>'
2. only merge: curl -g --request POST --header "PRIVATE-TOKEN: <your-secret-token>" 'https://gitlab.com/api/v4/projects/<your-project-id>/protected_branches?name=<branch-to-protect>&allowed_to_merge[][user_id]=<your-user-id>'

Output of checks

This bug happens on GitLab.com as well on a private hosted instance.