Handle Pending Project Memberships

What does this MR do and why?

In #332598 (closed), we need to restrict access to groups and projects for users with a pending / awaiting membership.

!75554 (closed) demonstrates all the work this requires as a whole.

This MR is a small part broken out from !75554 (closed) so that it can easily be reviewed for database performance changes and so forth.

This feature is being developed behind the :saas_user_caps feature flag. It is disabled in production.

Issue: #332598 (closed)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.