Prevent group rights "user.can_manage" if a user in this group is locked out

[Elblinator]

Current behaviour:
You can give a participant manage rights even though they are locked out

Reproduction:

• Put a participant in a group "blob"
• lock this participant out
• now give the group "blob" the permissions to manage users

Wanted behaviour:
If a user is locked out then their group(s) are not allowed to get the permission user.can_manage

[bastianjoel]

We could also just always allow unlocking out a user from a meeting.

That way it would not be a problem if a group gets those rights while a locked out user is in it because the user can still be unlocked.

[Elblinator]

We decided against the concept of always allowing to unlock participants because it is possible to prematurely unlock a participant, who cannot be locked out again due to their group permissions even though they should be re locked out