Prevent private group disclosure via parent_id

See merge request !2077

Before this commit, but still on this feature branch, the creation of
mattermost teams where a background job. However, it was decided it was
better that these happened as transaction so feedback could be displayed
to the user.

There are two problems in the current implementation:

1. If a project is marked for deletion via the `pending_delete` flag
and then the namespace was quickly deleted, it's possible that the
namespace skips over that project and leaves that project in
an orphaned state.

2. Before namespace deletion, the namespace attempts to clean up
all the relevant storage paths. However, if all projects have been
removed synchronously, then the namespace will not be able to clean anything.
To prevent this, we should load the paths to be deleted before
actually destroying projects.

The specs were missing this second case due to a permission issue
that caused project removal never to happen.

* Changed name of delete_user_service and worker to destroy
* Move and change delete_group_service to Groups::DestroyService
* Rename Notes::DeleteService to Notes::DestroyService

* Simplify code around group parent access check
* Rename 'Nested groups' to 'Subgroups' tab at group#show page
Signed-off-by: NDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Signed-off-by: NDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Prevent Groups to have smaller visibility than projects
Add default_group_visibility_level to configuration
Code improvements