Since commit 5f12e244, the write of implied groups is done directly in SQL,
bypassing the ORM writes, and thus bypassing the python constraints checks.
In particular such a constraint was added in f206714a.
We add back an explicit check of this constraint;
however we rewrite it in SQL to be fast.

closes odoo/odoo#35411

closes odoo/odoo#36769

Signed-off-by: Nans Lefebvre (len) <len@odoo.com>
Signed-off-by: Nans Lefebvre (len) <len@odoo.com>