Resolve project roles granted through group and project shares

What does this MR do and why?

• This is an experiment behind the resolve_project_access_from_memberships feature flag (per user, default off). It only changes direct access checks, where we check one user's access to a specific project. Searches and lists that decide which projects a user can see still use project_authorizations.
• Completes the membership-based resolver by adding group shares and project shares, so users who get access to a project through sharing are handled too.
• Follows the same rules as today's project_authorizations calculation, including the share lock: project shares apply only when sharing is explicitly not locked.
• Custom roles on shared resources follow the side with the lower access level, matching Authz::MemberRoleInSharedResource. Project shares only take a custom role from a direct membership of the invited group.
• Once project_authorizations is up to date, the highest role per project matches it.
• No new query shapes. It also loads memberships of the invited groups. Nothing calls it yet.

References

• Work item: https://gitlab.com/gitlab-org/gitlab/-/work_items/632453
• Builds on: !263756 (merged)

Screenshots or screen recordings

Not applicable, no UI changes.

How to set up and validate locally

1. Open a Rails console and pick a user and projects that include shared projects (via group share and project share).
2. Run Authz::UserProjectGrants.new(user.id).max_access_levels(ids).
3. Compare with user.project_authorizations.where(project_id: ids).pluck(:project_id, :access_level). Results should match.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.