AuthorizedProjectsWorker job queue ballooned while using API to add users

A customer did something as the following:

1. Using the API, created thousands of groups and projects.
2. Using the API, set the project visibility to visible or internal, conditional on their own internal factors.
3. For each user, add the user to a group, one API call at a time.

Somehow when we checked the authorized_projects queue, we saw 16 million jobs. We killed the queue via the Sidekiq admin panel, and then just ran this on the console:

count = 0
User.all.find_each do |user|
   user.refresh_authorized_projects
   count += 1
   puts count if (count % 100 == 0)
end

As far as I can tell, we refresh the user access whenever:

• A project is created
• Whenever a group is updated with the share_with_group_lock flag: https://docs.gitlab.com/ee/api/groups.html#update-group
• Whenever we link a project to a group

/cc: @lbot, @yorickpeterse