Make the GroupFinder specs more strict

Ensure the results match exactly and project authorizations do allow access to
sibling groups/projects deeper down.

Also apply WHERE scopes before running the UNION, to increase performance.
50 jobs for tc-fix-group-finder-subgrouping in 124 minutes and 15 seconds (queued for 1 minute and 30 seconds)