Users that are invited to the Workspace through Group should also be able to invite to Project

**What's it about?**
Currently, when a user is added to a Workspace through Group, the User can't be added to a sub-project of the workspace directly. The user must be invited to the Workspace Members, so that the user can be added to the sub-projects. Which doesn't make sense.

Users that are invited to the Workspace through groups should also be able to invite to Project too.

**What's the reason why we need it?**

I believe this is an important feature for Kubesphere. There're a few use cases:

* case one
* case two
* ...

Please leave your comments below if there's anyone agrees with me. Or just give me a thumb up.

**Area Suggestion**
/area iam
/kind feature-request

The issue points to the IAM area but names no files, tests, or entry points. First trace how group-invited Workspace users are authorized for direct Project membership, then identify the existing permission checks and tests covering Workspace and Project invitations. Done means the intended invitation behavior is implemented and verified for group-invited users without weakening unrelated access controls.

Written by the indexing model from the issue text.