All we need to prevent when the user is the last owner is that they
cannot remove themselves, and leave the group un-owned. The existing
call is too aggressive and prevents any action, even legitimate ones
like `:read_group`.

This change fixes that by naming the abilities we are trying to prevent.

This work was done as part of
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/40088, where
this caused a bug. Since it is isolated it can be pulled out.