fix(xo-web/VM): properly identify self user to hide unauthorized actions

[pdonias]

See Zammad#27288

Description

In order to hide some VM actions from the user, we check if the current user belongs to a resource set. But we also need to check if they belong to a group that belongs to a resource set.

Checklist

• Commit
  • Title follows commit conventions
  • Reference the relevant issue (Fixes #007, See xoa-support#42, See https://...)
  • If bug fix, add Introduced by
• Changelog
  • If visible by XOA users, add changelog entry
  • Update "Packages to release" in CHANGELOG.unreleased.md
• PR
  • If UI changes, add screenshots
  • If not finished or not tested, open as Draft