Test that User's Project access terminated when Membership terminated

Summary

We've discovered multiple cases where parent records can be deleted/disabled without triggering deleting/disabling of child records. This has exposed a number of security issues (e.g. #31522 (closed), #31533, #36720) where people continue to have some level of access to Projects after their Membership has been removed. It seems wise to have some sort of broad protection against this type of problem, and @ahegyi suggested adding test coverage.

Proposal

There is an RSpec test that:

1. Iterates through all models related to the Project model, e.g. DeployKeyProject and ProjectDeployToken (both of which belongs_to :project).
2. Selects all User associations from those model, e.g. DeployKeyProject.belongs_to :user.
3. Confirms all those User-associated records are either destroyed or the foreign key values nullified when the User's membership in the Project is terminated.