Add group-based impersonate rule support

[oneonestar]

The current impersonation-rules only supports original_user, original_role and new_user.

Adding original_group and new_group would allow fine grained access control. For example:

{
    "impersonation": [
        // this allow admin role to impersonate any user, except for users in admin_group
        {
            "original_role": "admin",
            "new_group": "admin_group",
            "allow": false
        },
        {
            "original_role": "admin",
            "new_user": ".*"
        },
        // only users in batch_system_admin_group can impersonate users in batch_users_group
        {
            "original_group": "batch_system_admin_group",
            "new_group": "batch_users_group"
        },
        // only users in tester_group can impersonate the test user
        {
            "original_group": "tester_group",
            "new_user": "test"
        }
    ]
}