[WPB-10772] Make it impossible for a user under legalhold to join an MLS conversation

[MangoIV]

Two things to do:

• prevent a third party from fetching key packages from a user under legalhold
• prevent a user under legalhold to add itself to a group

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[MangoIV]

-- ---------
-- WPB-10783
-- ---------
testMLSThenLegalhold :: (HasCallStack) => App ()
testMLSThenLegalhold = do
  -- scenario 1:
  -- if charlie is in any MLS conversation, he cannot approve to be put under legalhold
  (charlie, tid, []) <- createTeam OwnDomain 1
  [charlie1] <- traverse (createMLSClient def) [charlie]
  void $ createNewGroup charlie1
  void $ createAddCommit charlie1 [charlie] >>= sendAndConsumeCommitBundle

  legalholdWhitelistTeam tid charlie >>= assertStatus 200
  withMockServer def lhMockApp \lhDomAndPort _chan -> do
    postLegalHoldSettings tid charlie (mkLegalHoldSettings lhDomAndPort) >>= assertStatus 201
    requestLegalHoldDevice tid charlie charlie >>= assertSuccess
    approveLegalHoldDevice tid (charlie %. "qualified_id") defPassword
      `bindResponse` assertLabel 409 "mls-legalhold-not-allowed"

[pcapriotti]

Looks good.