feat: do not allow non-members to modify member list

[link2xt]

This issue was ignored for the initial implementation of #6401 but it seems it does not hurt to ignore membership changes from non-members. It's still better to create a new group if you want someone removed to be unable to get back into the group or write into it, but this change also provides sufficient protection most of the time without breaking existing tests.

[link2xt]

Best reviewed with "hide whitespace" on.

[iequidoo]

In #6401 you wrote:

Any attempts to e.g. ignore adding self to the group will result in "member is not part of the group" errors due to reordering in cases without any attackers.

Is there any plan of fixing this? Maybe add such messages as "partially downloaded" (but with some explanation)? This way they are hidden because may be malicious and also when the user downloads such a message later and the sender is already a member, it should be shown correctly. The downside is that the message is downloaded twice, but that shouldn't happen frequently.

[link2xt]

Need to test what actually happens when someone tries to add self to verified group before this PR. They should not be able to "introduce self". If they can, that's a bug, and if they cannot, then there is an error in case of reordering anyway.

EDIT: we already have test_verified_member_added_reordering test.