Various fixes for allowed_groups and admin_groups

[consideRatio]

Ensures allowed_groups and admin_groups works as in all authenticator classes by adding tests and resolving some implementation details. The fixes are to unreleased changes, so this is considered a maintenance PR rather than bugfix.

• Fixes New group config in OAuthenticator overlaps with allowed_google_groups for example and may not work - what do we do? #756

[consideRatio]

@minrk this isn't perfect, but it catches a few issues correctly at least I think.

Do you have work in progress related to actual fixes? This PR is 100% tests and docs currently.

[minrk]

Do we want to keep this test realistic? I don't think this is a real field on the user model returned from the gitlab API.

[consideRatio]

For now i'm happy to settle with this, but i think its worth looking up how this can be realistic for all authenticator classes responses - requires some effort though

[consideRatio]

I opened #759 to reflect this

[minrk]

I moved the manage_groups logic outside of update_auth_model so it's unconditional, private, and not overrideable. Classes can implement get_user_groups to govern this behavior. All tests are passing. Left one comment in-line about whether the mock responses should be kept realistic, because right now we are injecting group fields that aren't going to be there. I think that's fine for the purposes of what we want to test.

[consideRatio]

@minrk I pushed a few more commits and think I'm happy with things now - go for merge?

[minrk]

@consideRatio looks great, thank you!