3687: add functional test for sharing within a group

Test that two unprivileged users in the same group can share collections.
3687: in User#can?, consider permission links with head_uuid pointing directly at the target.
3687: OK here just means this loop is OK, not everything is OK!
3687: Add comment about redundant lookup.
3687: Merge branch 'master' into 3687-grant-permission-on-repo-TC
Merge branch '3687-grant-permission-on-repo-TC' closes #3687