feat(gitlab): support inherited group claims

[AntonKulyashov]

Overview

Add inherited group support to the GitLab connector.

What this PR does / why we need it

GitLab's /oauth/userinfo response only includes groups where the user is a direct member. This means Dex can miss inherited group memberships and reject users when group filtering depends on subgroup membership inherited from a parent group.

This PR adds an inheritedGroups option to the GitLab connector. When enabled, Dex uses /api/v4/groups as the source of truth for group names so inherited memberships are included. To support that flow, the connector requests read_api in addition to the existing read_user and openid scopes.

This PR also keeps getGroupsPermission working with inherited groups. Dex first uses permission claims from /oauth/userinfo where possible, and only falls back to per-group effective membership lookups when needed. If GitLab returns 403 or 404 for one of those fallback permission lookups, Dex skips the suffix for that group instead of failing the entire authentication flow.

Tests were added for:

• scope selection
• inherited group loading
• pagination
• filtering with inherited groups
• permission enrichment with inherited groups
• graceful handling of forbidden permission lookups