Follow-up to story #12554

• Project admin can no longer add restricted users to project members (and user groups)
  • Users are not proposed in autocompletion
• When a user is switched to restricted, the user is removed from all projects that are "private w/o restricted" (and all user groups)
  • There is a warning message to confirm the action (User is going to be removed from X projects).
• When a project is switched to "private w/o restricted", all restricted users are removed from project members (and all user groups)
  • There is a big warning message specific to this switch to confirm (when there are restricted): "X users are going to be removed from this project".
• Binding of user groups must filter restricted users when target group is a "private w/o restricted" project.
• On LDAP sync of user groups, the users are filtered to remove restricted that should land in "private w/o restricted" project.
  • Warning, user filters (that control how users are created/updated on the platform from LDAP) must be applied before the "private w/o restricted" filter.
• The 4 level of project access must be managed a project creation
  • Should be proposed in the web UI
  • Should be managed as default value for project creation
    • The local.inc config "$sys_is_project_public = 1;" is put in the DB (and can manage de 4 possible default values) and managable by the web ui and "tuleap set-config" CLI