feat: manage a user's groups from the user form, privileged groups locked

- groups relation field on the user form, the only writer of users_groups
- UsersGroup pivot model
- AdminRelationLocks: adding or removing a group whose code is in
  golem15.user.privileged_groups needs golem15.users.manage_privileged_groups,
  on create and on update; refused saves answer 403 and write nothing
- TestAdminUserGroupsField and TestAdminPrivilegedGroups

controllers/admin_registry.go

@@ -34,5 +34,6 @@ func init() {
 	var _ pact.FormBeforeCreate = usersAdminController{}
 	var _ pact.FormAfterCreate = usersAdminController{}
 	var _ cabana.FieldRelationProvider = usersAdminController{}
+	var _ cabana.RelationLockProvider = usersAdminController{}
 	var _ cabana.PermissionEditorProvider = usersAdminController{}
 }