Refactor protected_ref_access to use active_project_member?

The following discussion from !156664 (merged) should be addressed:

• @jwoodwardgl started a discussion:

  note: we call the same method on line 116. I'm refactoring that method in another MR so will replace with active_project_member? after we merge this MR to prevent merge conflicts