Add admin.users service accounts that bypass group authz

[johnworth]

Summary

• Add an admin.users configuration key: a list of trusted service account usernames that bypass all per-group permission checks (requireLevel and requireReadOrMember)
• Listed accounts get full administrative control over every group — intended for internal DE services such as the permissions service, which needs to read any group's membership when resolving permissions
• Default is empty, which disables the bypass entirely; the user query parameter requirement still applies to admin accounts
• No HTTP API surface changes

This is the groups-service half of letting the DE permissions service resolve group memberships through this service instead of the Grouper database (see cyverse-de/permissions#groups-backend).

Test plan

• New authz tests: admin bypasses the member-read path and the write-level path; non-admin, non-member users still get 403
• Full suite via just test; golangci-lint run clean

🤖 Generated with Claude Code