OIDC groups implementation

- Add Groups field to User struct with JSON storage
- Include GetGroups() and SetGroups() helper methods
- Extract groups from OIDC claims in FromClaim()
- Add database migration 202509161200 for groups column
- Update config-example.yaml with groups scope
- Add comprehensive documentation and testing

docker-dev/headscale-config.yaml

@@ -0,0 +1,70 @@
+# Headscale configuration for Docker development environment
+server_url: http://headscale:8080
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 0.0.0.0:9090
+grpc_listen_addr: 0.0.0.0:50443
+grpc_allow_insecure: true
+
+# Noise protocol private key for Tailscale v2
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+
+# IP allocation for nodes
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+
+# DERP server configuration
+derp:
+  server:
+    enabled: false
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+
+# Disable real HTTPS in dev environment
+tls_cert_path: ""
+tls_key_path: ""
+
+# Database configuration
+database:
+  type: sqlite3
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+
+# Ephemeral node configuration
+ephemeral_node_inactivity_timeout: 30m
+
+# Node management
+node_update_check_interval: 10s
+
+# Logging
+log:
+  level: debug
+  format: text
+
+# DNS configuration
+dns:
+  magic_dns: true
+  base_domain: headscale.local
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 8.8.8.8
+  search_domains: []
+
+# Policy configuration
+policy:
+  mode: file
+  path: /etc/headscale/acl.hujson
+
+# CLI configuration
+cli:
+  timeout: 5s
+  insecure: false
+
+# Disable random server_url check
+disable_check_updates: true