Rework project authorizations and nested groups for better performance

See merge request !10885