Enabling member lock should disable group additions
Problem to solve
Member lock for Groups is intended to be a lock on adding members. In the documentation, we state that "... if you want to lock the group for an Audit Event, you enable Member Lock to guarantee that any membership is added or changed during the audition."
However, member lock doesn't provide this guarantee. While attempting to add users to individual projects within the group will fail (we disable this option in the UI and API requests to do this fail), users with appropriate permissions can still add users to the group. Adding users to a group will add them to nested projects, thus defeating member lock.
Proposal
If member lock is enabled for a group, attempts to add new members to the group will fail (via UI and API).
What does success look like, and how can we measure that?
After this change, the only way to add users to a member-locked group (and any nested project) should require disabling member lock first.