dbf7978b introduced a regression where protected branches and tags
could only be added if the user getting access to push or merge was a
direct member of the project. However, this does not consider that
team members can gain access to a project via group membership. Fix this
by checking the user has any access within the team.

Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/9591