feat: manage a user's groups from the user form, privileged groups locked

- groups relation field on the user form, the only writer of users_groups
- UsersGroup pivot model
- AdminRelationLocks: adding or removing a group whose code is in
  golem15.user.privileged_groups needs golem15.users.manage_privileged_groups,
  on create and on update; refused saves answer 403 and write nothing
- TestAdminUserGroupsField and TestAdminPrivilegedGroups

models/user/fields.yaml

@@ -35,6 +35,12 @@ fields:
         span: right
         tab: golem15.user::lang.user.account
         context: [create, update]
+    groups:
+        label: golem15.user::lang.user.groups
+        type: relation
+        span: full
+        emptyOption: golem15.user::lang.user.empty_groups
+        tab: golem15.user::lang.user.account
     organisation:
         label: golem15.user::lang.organisation.label
         type: relation