Ensures that Group SAML SSO session enforcement applies to projects,
even when the user has been granted owner permission from the group.

Avoids a simple 'prevent :read_project' as that would break admin
access as well as preventing public access.