Fix AccessibleTeamReposEnv.RepoIDs can not get the correct result

[yp05327]

Possibly fix #32677

There are two function we can remove a member from an organization.
RemoveOrgUser and RemoveTeamMember

RemoveTeamMember seems correct, as by my test it can correctly update the watch list.
But for RemoveOrgUser, it can not correctly remove the watch list for private repos in the organization, as there's a miss in the condition.

About the fix:
If user is null or user is restricted, then we need to add the condition to filter the private repos.
But the logic now is if user is not restricted, only public repos will be count.

This line comes from:
https://github.com/go-gitea/gitea/pull/6274/files#diff-780b130df406563b7f1b2dd8add33e4160a91f9a130ef99f7282389e20ea9efbR777

[lunny]

Looks like the fix is unrelated to the #32677 ? Can you confirm the user is restricted? And BTW maybe you need a test for that.

[yp05327]

Looks like the fix is unrelated to the #32677 ?

When user leave the org and RemoveOrgUser was used, it is using AccessibleReposEnv to get the repo ids which user should unwatch the repo. But because of the logic problem, it can not get the private repo ids when the user is not restricted.

But sometimes (there are many approachs to leave the org), RemoveTeamMember was called, and it can correctly unwatch all repos.