Fix protected branch access inherited from parent group

Suppose you have this configuration:

1. Subgroup hello/world
2. Subgroup hello/mergers.
3. Project hello/world/my-project has invited group hello/world to access protected branches.
4. The rule allows the group to merge but no one can push.
5. User newuser has Owner access to the parent group hello.

Even though newuser doesn't belong to hello/world, the user does belong to hello, and so should have permission to merge to protected branches. Besides, the user can't be added directly to hello/world because he is already an Owner.

To fix this, we expand the protected branch access to check to include membership in parent groups as well.

Closes #11323 (closed)