Support google groups for privileged users

[ViniciustCosta]

Add support for google groups to manage privileged users on Clusterfuzz UI.

Changes

• Added a new field on the configuration form to allow for admins to add privileged groups (this was done to maintain the support for adding direct emails on the privileged users field).
• Added methods based on the Cloud Identity Groups API in order to retrieve the group ID and to check membership of a logged user. If the user is not a member of the group or the appengine service account doesn't have access to the group, the access will be denied.

Tests

• Unit tests
• Testing in development by deploying this changes and checking the access with help of the team.
  • Tested admin access still working.
  • Tested that members of a group (test-acl-clusterfuz) had privileged access.
  • Tested that member directly added to the privileged users field had access.

Limitations

Notice that, for now, this support is limited to groups that are accessible by the Clusterfuzz appengine service account. I.e., groups must either be public or have the service account as a member. Due to internal security policies, the appengine service account does not have domain-wide delegations needed to check membership within any google group. There is a possible workaround by leveraging the user's OAuth credentials when calling the API that might be implemented in the future.

Bug: b/429657295

[vitaliset]

Nice work Vini! :)

[javanlacerda]

LGTM!