Like check_access_permissions() but for write_stat() hook instead of access(). Basic logic copied from BFS, but with the UID/GID logic rewritten to better conform to behavior on other OSes: notably, we allow chown() requests that keep the UID the same to go through, same as Linux seems to, which should fix #19666. We now also validate that the GID is one of the current team's groups.