User doesn’t have access to projects shared with a group if they're a member of one of that group's ancestors but not of the group itself directly

Part of https://gitlab.com/gitlab-org/gitlab-ce/issues/2772

https://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/services/users/refresh_authorized_projects_service.rb#L121 needs to also look at nested_groups, I think.