Add two-tier RBAC: permission/role groups, access policies, group claim

Introduce a user -> role -> [permissions] model for app access and roles,
managed declaratively.

- Permission groups (akP-<app>-<access>) under config/permissions/: atomic units,
  each names the application it grants access to.
- Role groups (akR-<role>) under config/roles/: what users are assigned to;
  each nests permission groups via parents (akR-global-admin -> all *-admin,
  akR-standard-user -> all *-user). Split into a separate authentik_group
  resource so roles can reference permission ids without self-reference.
- Policy bindings gate each application to its permission groups (and, via
  child->parent membership propagation, the roles that nest them).
- Hierarchical `groups` scope mapping: walks user groups up through .parents so
  the OIDC claim includes inherited permission groups (works around
  goauthentik/authentik#15579). Inert until a provider requests the `groups`
  scope, so no behaviour change to existing apps until they opt in.

Validated with `tofu validate`.

environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl

@@ -17,8 +17,10 @@ terraform {
 }
 
 inputs = {
-  groups           = local.config.groups
-  providers_saml   = local.config.providers_saml
-  providers_oauth2 = local.config.providers_oauth2
-  providers_ldap   = local.config.providers_ldap
+  groups            = local.config.groups
+  permission_groups = local.config.permission_groups
+  role_groups       = local.config.role_groups
+  providers_saml    = local.config.providers_saml
+  providers_oauth2  = local.config.providers_oauth2
+  providers_ldap    = local.config.providers_ldap
 }