fix(provisioning_api): let sub-admins change group memberships

[pringelmann]

Summary

Since 34 the account edit dialog sends group changes as a groups array in PATCH /cloud/users/{userId}. That endpoint rejected the field for anyone who is not a full or delegated admin, so sub-admins can no longer change the groups of an existing account, not even their own. Creating an account with those groups and the POST endpoints have always allowed it.

Sub-admins can now add and remove the groups they administer:

• additions are checked per group against the caller's sub-admin groups
• groups they do not administer stay as they are, since the dialog only ever sends part of the list
• the request is rejected if it would leave the account in none of their groups, same rule as removeFromGroup

subadminGroups stays admin only, and adding to the admin group is still full admin only.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI (tests)

[pringelmann]

/backport to stable34