Don't let a group's members share its mailboxes on

A group's members reach its mailbox through membership, which counts
as owning the account, so every ACL check was skipped: on a scratch
server a member gave an outsider read access to the group's Inbox with
one Mailbox/set shareWith, with no administrator involved and nothing
audited. Who is in a group is an administrator's decision.

AccessToken::is_group_member_only names that case (in the account
only through a group, without Impersonate). For such a member:

- Mailbox/set with a shareWith change, on create or update, is
  refused as forbidden;
- IMAP SETACL and DELETEACL answer NO [NOPERM];
- myRights reports mayShare false, and MYRIGHTS leaves out "a";
  every other right stays.

Administrators and the account itself are unchanged. The JMAP ACL
test's group section now checks all three for a member and that the
outsider still has nothing (specs/multi-account.md, MA-D0, G1).

jmap_tests and imap_tests pass (RocksDB). The IMAP refusal has no test
of its own yet; imap_tests passing shows the rest is unchanged.

crates/jmap/src/mailbox/set.rs

@@ -613,6 +613,15 @@ impl MailboxSet for Server {
         // Refresh ACLs
         let current = update.map(|(_, current)| current);
         if has_acl_changes {
+            // inbuxa: MA-D0: a group's members don't share its mailboxes on.
+            if ctx.access_token.is_group_member_only(ctx.account_id) {
+                return Ok(Err(SetError::forbidden()
+                    .with_property(MailboxProperty::ShareWith)
+                    .with_description(
+                        "This mailbox belongs to a group. Only an administrator can change who has it.",
+                    )));
+            }
+
             if !changes.acls.is_empty()
                 && let Err(err) = self.acl_validate(ctx.account_id, &changes.acls).await
             {