user_groups: Add allow_nobody_group to access_user_group_for_setting.

This commit adds allow_nobody_group parameter to
access_user_group_for_setting with a default value of True.

zerver/tests/test_subs.py

@@ -541,6 +541,19 @@ class TestCreateStreams(ZulipTestCase):
             "'can_remove_subscribers_group' setting cannot be set to '@role:owners' group.",
         )
 
+        nobody_group = UserGroup.objects.get(name="@role:nobody", is_system_group=True, realm=realm)
+        post_data = {
+            "subscriptions": orjson.dumps(
+                [{"name": "new_stream3", "description": "Third new stream"}]
+            ).decode(),
+            "can_remove_subscribers_group_id": orjson.dumps(nobody_group.id).decode(),
+        }
+        result = self.api_post(user, "/api/v1/users/me/subscriptions", post_data, subdomain="zulip")
+        self.assert_json_error(
+            result,
+            "'can_remove_subscribers_group' setting cannot be set to '@role:nobody' group.",
+        )
+
 
 class RecipientTest(ZulipTestCase):
     def test_recipient(self) -> None:
@@ -2104,6 +2117,16 @@ class StreamAdminTest(ZulipTestCase):
             "'can_remove_subscribers_group' setting cannot be set to '@role:owners' group.",
         )
 
+        nobody_group = UserGroup.objects.get(name="@role:nobody", is_system_group=True, realm=realm)
+        result = self.client_patch(
+            f"/json/streams/{stream.id}",
+            {"can_remove_subscribers_group_id": orjson.dumps(nobody_group.id).decode()},
+        )
+        self.assert_json_error(
+            result,
+            "'can_remove_subscribers_group' setting cannot be set to '@role:nobody' group.",
+        )
+
         # For private streams, even admins must be subscribed to the stream to change
         # can_remove_subscribers_group setting.
         stream = self.make_stream("stream_name2", invite_only=True)