Add :admin_groups GraphQL endpoint for /admin/groups page

What does this MR do and why?

Similar to Add :admin_projects GraphQL endpoint for /admin... (!201411 - merged), this MR adds a dedicated :admin_groups GraphQL endpoint specifically for the /admin/groups page, replacing the previous approach of reusing the :groups endpoint.

The new endpoint returns groups as GroupInterface which can either be GroupType or GroupMinimalAccessType depending on the current user's permission on the group (read_group or only read_group_metadata).

Why

The existing :groups endpoint is widely used throughout the application. Modifying it to return GroupInterface type introduces high risk of backward compatibility issues (e.g. existing queries will need to specify which concrete type a field belongs to¹). A dedicated :admin_groups endpoint scopes the GroupInterface usage to the admin groups page only, reducing risk.

¹

// if :groups field is updated to return GroupInterface instead of GroupType

// before
groups {
   nodes {
      a_field_in_group_type
      a_field_in_group_type
   }
}

// after, queries will need to specify which type a field belongs to (a breaking change)
groups {
   nodes {
      ... on Group {
         a_field_in_group_type
         a_field_in_group_type
      }
   }
}

References

Allow read-only access to `Admin Area > Project... (#557844 - closed).

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.