fix: better handle project nesting around TLP

• fix: update http wrapper test to sidestep upstream bug w/ profile

• fix: better handle project nesting around TLP

Previously, as permissions were collated for group cleanup, newer permissions would clobber old permission sets. This led to edge-case issues where users in a TLP with higher perms in a sub project would get bounced in runs as the permissions get added and removed on each run.

This is still not a good state to be in, but we shouldn't be email spamming these users in this case.