[FIX] base: check group constraints when adding implied groups

Since commit 5f12e244, the write of implied groups is done directly in SQL,
bypassing the ORM writes, and thus bypassing the python constraints checks.
In particular such a constraint was added in f206714a.
We add back an explicit check of this constraint;
however we rewrite it in SQL to be fast.

closes odoo/odoo#35411

closes odoo/odoo#36769

Signed-off-by: Nans Lefebvre (len) <len@odoo.com>
Signed-off-by: Nans Lefebvre (len) <len@odoo.com>