FIX: down downgrade trust level if all requirements are met. (#25953)

Currently, the trust level method  is calculating trust level based on maximum value from:
- locked trust level
- group automatic trust level
- previously granted trust level by admin

https://github.com/discourse/discourse/blob/main/lib/trust_level.rb#L33

Let's say the user belongs to groups with automatic trust level 1 and in the meantime meets all criteria to get trust level 2.

Each time, a user is removed from a group with automatic trust_level 1, they will be downgraded to trust_level 1 and promoted to trust_level 2

120a2f70a9/lib/promotion.rb (L142)

This will cause duplicated promotion messages.

Therefore, we have to check if the user meets the criteria, before downgrading.

spec/models/group_user_spec.rb

@@ -303,5 +303,27 @@ RSpec.describe GroupUser do
       # keep in mind that we do not restore tl3, cause reqs can be lost
       expect(user.reload.trust_level).to eq(2)
     end
+
+    it "protects user trust level if all requirements are met" do
+      Promotion.stubs(:tl2_met?).returns(true)
+
+      user = Fabricate(:user)
+      expect(user.trust_level).to eq(1)
+
+      group.update!(grant_trust_level: 1)
+
+      Promotion.recalculate(user)
+      expect(user.reload.trust_level).to eq(2)
+
+      group_user = Fabricate(:group_user, group: group, user: user)
+      expect_not_enqueued_with(
+        job: :send_system_message,
+        args: {
+          user_id: user.id,
+          message_type: "tl2_promotion_message",
+        },
+      ) { group_user.destroy! }
+      expect(user.reload.trust_level).to eq(2)
+    end
   end
 end