Implement QualifiedGroupsFilter logic

What does this MR do and why?

Implement QualifiedGroupsFilter logic

This change implements logic to find qualified groups for code owner entries.

Qualified groups include:

1. The project's group
2. The project's group's ancestors
3. Any invited groups with a max role value of at least Developer

In a follow-up we will add the error_message to the frontend logic so it can be rendered correctly.

Currently behind a feature flag [Feature flag] Rollout of `accessible_code_owne... (#524437 - closed)

Related to Group Max Role validation (#521151 - closed)