Unable to change project settings when Duo is disabled in the top-level group

Summary

If Duo is disabled in the top level group and the checkmark Enforce for all subgroups is enabled, when admins attempt to make changes in the projects they get the following error: Project setting duo features enabled cannot be changed because it is locked by an ancestor

Steps to reproduce

1. Enable Duo in the project level
2. Turn off Duo in the top level group and ensure Enforce for all subgroups is enabled
3. Attempt to modify any project level settings
4. Observe the Project setting duo features enabled cannot be changed because it is locked by an ancestor error

Output of checks

This bug happens on GitLab.co