[UserCap BE]: Group access modifications

Why are we doing this work

In &4315 (closed), we introduced a User Cap setting for self-managed admins to prevent accidental user overages, now we are doing the same for SaaS group owners to prevent accidental overages.

This work will be broken down into the following backend steps:

• Add user cap setting
• Adding/inviting members
• Notifications
• Member management
• Auto approval
• Approval Modal
• Group access modifications: 👈 we are here
• Group sharing
• UserCap availability

We need to restrict full access to group members if their state is pending, we can do this by modifying the access policy to include a state check once that has been implemented as part of #332592 (closed)

Relevant links

• Epic: &5803 (closed)
• Designs: #321934[V4.png], #328680[pending.png]

Implementation plan

• Modify access policy to include state*

*This should probably be behind a feature flag to prevent confusion until the full feature is ready