remove experiments for 2fa requirements and fix tests

app/models/group.rb

@@ -423,7 +423,7 @@ class Group < Namespace
   def update_two_factor_requirement
     return unless saved_change_to_require_two_factor_authentication? || saved_change_to_two_factor_grace_period?
 
-    [users_with_descendants, project_users_with_descendants].each {|set| set.find_each(&:update_two_factor_requirement)}
+    User.from_union([users_with_descendants, project_users_with_descendants]).find_each(&:update_two_factor_requirement)
   end
 
   def path_changed_hook

app/models/user.rb

@@ -728,8 +728,8 @@ class User < ApplicationRecord
   end
 
   def expanded_groups_requiring_two_factor_authentication
-    all_expanded_groups.where(require_two_factor_authentication: true).merge(
-      authorized_groups.where(require_two_factor_authentication: true))
+    Group.from_union([all_expanded_groups.where(require_two_factor_authentication: true),
+                      authorized_groups.where(require_two_factor_authentication: true)])
   end
 
   # rubocop: disable CodeReuse/ServiceClass

spec/models/group_spec.rb

@@ -633,7 +633,11 @@ describe Group do
 
       group.update!(require_two_factor_authentication: true, two_factor_grace_period: 23)
 
+      if Group.supports_nested_objects?
         expect(calls).to eq 2
+      else
+        expect(calls).to eq 1
+      end
     end
 
     it 'calls #update_two_factor_requirement on each group member' do