Fix self-referential authentik_group parents

Adding the first managed group (argocd-admins) exposed a dormant bug: the
groups resource resolved `parents` by indexing authentik_group.this itself,
which OpenTofu rejects as a self-referential block. config/groups/ had been
empty, so `tofu plan` never hit it before.

Pass `parents` through as literal group PKs instead (the resource cannot
reference itself, so parent-by-map-key was never viable). Plan is clean:
3 to add (argocd provider, application, argocd-admins group).

modules/authentik/variables.tf

@@ -2,8 +2,10 @@ variable "groups" {
   type = map(object({
     name         = string
     is_superuser = optional(bool, false)
-    parents      = optional(list(string), null)
-    attributes   = optional(map(string), {})
+    # PKs of existing parent groups. These must be literal group PKs, not keys
+    # into this map: authentik_group cannot reference itself.
+    parents    = optional(list(string), null)
+    attributes = optional(map(string), {})
   }))
   default = {}
 }