Implement groups

- Create a new `groups` scope and claim
- Groups are defined on the intersection between users and clients
- Groups are exposed to clients respecting the given scope and the relationship between the user and client
- Only admins can define groups for users-clients