feat: User Groups admin screen with the users count and privileged codes protected

- controller golem15.user.usergroups behind golem15.users.access_groups
- list with users_count from the list's own query; form with the checkbox
  permission editor stored in user_groups.permissions
- creating a group with a privileged code, changing a code to or from one and
  deleting a privileged group need golem15.users.manage_privileged_groups
- a group delete removes its users_groups rows in the same transaction
- UserGroup gains Fillable, Rules and the read-only UsersCount; PermissionSet.Text
- TestAdminGroups and the D-06 matrix in TestAdminPrivilegedGroups

admin_navigation.go

@@ -25,6 +25,13 @@ func (*Plugin) Navigation() []pact.NavigationItem {
 					Permissions: []string{controllers.PermissionAccessUsers},
 					Controller:  "golem15.user.users",
 				},
+				{
+					Code:        "usergroups",
+					Label:       "golem15.user::lang.groups.all_groups",
+					Icon:        "users",
+					Permissions: []string{controllers.PermissionAccessGroups},
+					Controller:  "golem15.user.usergroups",
+				},
 			},
 		},
 	}