FIX: Allow only groups with flairs to be selected (#13744)

It used the same permission check as for primary groups which is
wrong because not all groups that can be primary have a flair.

lib/guardian.rb

@@ -323,6 +323,12 @@ class Guardian
     (group ? !group.automatic : false)
   end
 
+  def can_use_flair_group?(user, group_id = nil)
+    return false if !user || !group_id || !user.group_ids.include?(group_id.to_i)
+    flair_icon, flair_upload_id = Group.where(id: group_id.to_i).pluck_first(:flair_icon, :flair_upload_id)
+    flair_icon.present? || flair_upload_id.present?
+  end
+
   def can_change_primary_group?(user)
     user && is_staff?
   end