Allow composite identity SAs to bypass SAML membership lock

What does this MR do and why?

Fixes a regression where non-admin users (including group/project Owners) cannot enable Duo Flows on a self-managed instance when all of the following conditions hold:

1. Admin > Settings > General > Visibility and access controls > "Lock memberships to SAML Group Links synchronization" is enabled (lock_memberships_to_saml: true)
2. The saml_group_sync licensed feature is available
3. The root ancestor group has at least one SAML group link configured

In that configuration, the policy rule in ee/app/policies/ee/project_policy.rb prevents :admin_project_member for all non-admins:

"Could not enable flow not authorized to create member"

References

• Resolves #596143
• Related: #577607 (closed) & !224066 (merged) & Related: !223735 (merged)

How to set up and validate locally

1. Configure instance-level SAML SSO.
2. In Admin > Settings > General > Visibility and access controls, enable "Lock memberships to SAML Group Links synchronization".
3. Ensure the saml_group_sync licensed feature is available.
4. Add at least one SAML group link to a top-level group.
5. Sign in as a group/project Owner (non-admin) on a project in that group.
6. Attempt to enable a Duo Flow on the project.
7. Expected: the flow is enabled successfully (previously failed with "not authorized to create member").

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.