Add BSO check for group members (GitLab.com and Self-Managed) LDAP

What does this MR do and why?

On Lightweight Directory Access Protocol (LDAP) synchronization, users can get added to groups. In case we are on Self-Managed (SM), Block Seat Overages (BSO) is activated and there are no seats left, we want to avoid assigning the member elevated permissions, but instead want to limit it to the Minimum Access (MA) level.

Suppose the user is already using a seat (from a previous role or configuration that was billable) or BSO is not activated. In that case, we allow assigning the access level received from LDAP.

This merge request is based on a merge request that implements the foundational module for this code change: Add foundation module for BSO seat check (!201940 - merged) and it will be merged afterwards.

References

• Contributes https://gitlab.com/gitlab-org/gitlab/-/issues/513219

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. Start your Ultimate (with a 1-seat license) Self-Managed instance
2. Execute Feature.enable(:bso_minimal_access_fallback)
3. Ensure you have activated LDAP support; see more here.
4. Create a group
5. Go to the group's settings and click on LDAP Synchronization
6. Create a new synchronization.
   1. Choose LDAP group cn
   2. Choose for LDAP group cn group1 where John and Mary are members
   3. Choose for LDAP access Maintainer
   4. Click on Add synchronization
   5. Check the state here http://localhost:3000/groups/group1/-/group_members and ensure the synchronization started.
   6. Check the state of synchronization worker here http://localhost:3000/admin/background_jobs
7. Check the members that the role is Minimum Access and not Maintainer (see screenshots above)

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.