fix: update rbac/candid users openfga group membership

[alemar99]

Before Openfga we were relying on the is_superuser field of the User model. When we introduced Openfga, we added a Django signal which automatically assigns the openfga group on the user creation based on the is_superuser property. However, with candid/rbac that property is only populated AFTER user creation, resulting in all the users belonging to the "Users" group. This commit enables the possibility to re-evaluate the group membership every time the user gets re-validated through Candid or RBAC. This only works with the two default groups that we have (i.e. Users and Administrators).

[github-actions]

[maas-code-reviewer review]

LLM-generated review from https://github.com/canonical/maas-code-reviewer.
Intended to assist a human reviewer, not replace one — suggestions may be
incorrect, please verify before acting.

The PR correctly aims to keep OpenFGA group memberships in sync when a user's Candid or RBAC permissions are re-evaluated. However, there is a critical bug where the newly added async function is called directly from synchronous code in the legacy authentication backend, preventing it from executing.

Please see the inline comments for details on how to fix this.

[alemar99]

QA steps:

• setup MAAS with Candid+RBAC
• Login
• The error message "This MAAS has not be configured." appears.

With this patch:

• after login, you should be able to see the Welcome to MAAS page with the initial setup.

Setting up candid/rbac can be tedious, shameless plug for https://github.com/alemar99/maas-dev-scripts :
Make sure to download the canonical-rbac deb package and copy it to the root of the repo as 'rbac_stable.deb'. Then:

# Checkout this branch in the MAAS repo
git remote add alemar99 ...
git checkout alemar99/fix-candid-rbac-openfga-groups
# In the maas-dev-scripts repo run:
./maas-env.py create snap rbac-38 --channel=3.8/candidate --post /scripts/rbac_setup.sh:all
# Follow manual instructions for rbac
./maas-env.py shell rbac-38
# Execute commands as per the instructions, then
./maas-env.py sync rbac-38 <path_to_your_maas_repo>
./maas-env.py overlay apply rbac-38

[r00ta]

if MAAS is using RBAC, we should not have any component that relies on openfga/rebac. The UI should not consult the entitlements in order to show what a user can/can't do. If a user comes from candid, it should land into the base group

[alemar99]

Summary from the meet we had with @r00ta :

• rbac users are not affected by openfga roles, so we can put them in the 'Users' group and not worry about this. We actually discovered that there's a missing piece in the v3 handlers for rbac and I'll fix it in another PR
• candid users: here we can follow two paths. First one is assign all the users to the 'Users' openfga group. Then the admin will have to manually create openfga groups if they want to mimic the behavior in candid. Solution two would be to automatically create groups that are in candid also in openfga. Then the admin will have to assign the correct privileges to each group (this one requires more effort and we have to evaluate the feasibility, also keeping in mind the switch to OIDC+openfga which already supports this).