Function elevate 

pub async fn elevate(
    pool: &PgPool,
    actor: &Actor,
    project_id: Uuid,
    reason: &str,
) -> AppResult<Elevation>

An administrator opens a time-limited elevation on a group whose policy is with_reason; until it expires the group is visible to them like to a member, with every guard.

Invariants

• Permission: administrators only (403); the policy of the group must be with_reason on a restricted group (400 when nothing is needed, 403 when administrators are shut out by none).
• Locks: the group row (FOR UPDATE).
• Data: the reason has 10 to 1000 characters (400); a running elevation of the same administrator is returned instead of a second one; the elevation lasts ELEVATION_MINUTES.
• Audit: project.elevate with the reason.
• Notifications / webhooks: the managers get an access alert (so does no one else); no webhooks.
• Atomic: one transaction.