feat: manage a user's groups from the user form, privileged groups locked

- groups relation field on the user form, the only writer of users_groups
- UsersGroup pivot model
- AdminRelationLocks: adding or removing a group whose code is in
  golem15.user.privileged_groups needs golem15.users.manage_privileged_groups,
  on create and on update; refused saves answer 403 and write nothing
- TestAdminUserGroupsField and TestAdminPrivilegedGroups

admin_users_test.go

@@ -1418,9 +1418,9 @@ func TestAdminUserFormFields(t *testing.T) {
 	}; !reflect.DeepEqual(offered, want) {
 		t.Fatalf("permission options = %v, want %v", offered, want)
 	}
-	// The form has no login-name, block-mail, guest or groups field (D-03,
-	// D-18, D-21; groups arrive with their guard).
-	if want := []string{"name", "surname", "email", "send_invite", "password", "password_confirmation", "organisation", "avatar", "created_ip_address", "last_ip_address", "permissions"}; !reflect.DeepEqual(names, want) {
+	// The form has no login-name, block-mail or guest field (D-03, D-18,
+	// D-21).
+	if want := []string{"name", "surname", "email", "send_invite", "password", "password_confirmation", "groups", "organisation", "avatar", "created_ip_address", "last_ip_address", "permissions"}; !reflect.DeepEqual(names, want) {
 		t.Fatalf("form fields = %v, want %v", names, want)
 	}