Rework membership on global entities and implement ProjectQueryRole

[klaustopher]

• Change the Membership model so that it explicitly supports entity present + project nil
• Add a ProjectQueryRole and the permissions
• Add an allowed_to scope for ProjectQuery
• Change visible and add editable method to ProjectQuery
• Add tests

---

Implements https://community.openproject.org/work_packages/55160
Implements https://community.openproject.org/work_packages/55161

[ulferts]

This is an unsolved question on my end. Doing this will have lead to the roles being written to the database. And we definitely want to have that for installations that just do a migration from say 14.0 to the current one. But it will do the same for new instances. And that renders the seeding of the roles worthless.

[klaustopher]

We had the same discussion when we introduced the roles for WorkPackages. First we planned to do it with seeds only, but later we still added them via a migration as well.

As we have a unique identfier with the builtin column being filled, the migration and the seeds would be idempotent as they would lead to the same result.

I have no problem removing them from the seeds, I just think it's more complete to have them in both.

[dombesz]

Well done @klaustopher !👍 I just left one question.