Similarly to disabled local groups, which are supported by MediaWiki core since 1.46 (and earlier by OATHAuth), we'd like to have disabled global groups, which would fulfill a similar purpose – 2FA enforcement (and other restricted groups, if configured).

Context

The implementation of restricted local groups is based on a few features:

1. allow granting the group only to people who meet conditions;
2. don't allow ineligible members of the group to use their rights;
3. optionally, demote the ineligible members from the group;
4. (for 2FA) make sure users won't become ineligible as long as they are members of the group.

Points 1. and 4. are implemented in T422119 and T423074. This task is to cover point 2.

It might seem that in a framework described above, there's no need for disabled groups, as the membership can be revoked as soon as the user is determined to be ineligible. However, disabling groups fulfills some needs of the project:

• When a group restriction is being rolled out (i.e., transitioning from "no restrictions" to "some restrictions" stage), having the group disabled but easily recoverable is more user-friendly, and is a way of giving users option to notice the change in requirements and adapt to it.
• Removing a group on view might reveal when user is active, which we don't want to do (we consider the risks not less than wrt. autocreate log entries, and probably higher). Remove-on-view might be also subject to some race conditions, if the first action would be attempt to write something.
• The site administrator may wish not to automatically demote the group members at all (not a case at Wikimedia).

Acceptance criteria

• Users who are no longer eligible for membership in a restricted global group (but are members of it) can no longer use permissions given by that group
• The membership gets disabled without a need to invalidate CentralAuthUser cache.
• Given that the status of a group being disabled is not shown publicly (as it may depend on private data), if it's requested for other user than self, ApiQueryGlobalUserInfo should list all rights for the target user, even those coming from their disabled groups