Remove Security Manager guards from add_security_manager

What does this MR do and why?

Group#add_security_manager and ProjectTeam#add_security_manager both return early when the Security Manager role is off. The role is always on, so neither guard can fire.

• Removed the return unless guard from both methods.
• Removed the two specs covering the disabled state and flattened the wrapper contexts around the remaining examples.
• Added :aggregate_failures to the group spec example, which has 2 expectations.

Second of several. 7 call sites left after this one.

How to set up and validate locally

bundle exec rspec spec/models/project_team_spec.rb
bundle exec rspec spec/models/group_spec.rb:4669:4692

124 examples, 0 failures.

References

#584144 (closed)

Part of the work in !239507 (closed)

Screenshots or screen recordings

No UI change.

🤖 Generated with Claude Code