auth: support OAuth group role assumption

[mihaimitrea-db]

Summary

• add auth login --group-id and --clear-group-id
• persist the effective group role in profiles and pass it through direct and discovery OAuth flows
• keep explicitly selected profiles isolated from ambient DATABRICKS_GROUP_ID
• report assumed-group state from auth describe
• add unit and acceptance coverage for persistence, switching, clearing, discovery, refresh, cache isolation, and OAuth rejection

Dependency

Depends on databricks/databricks-sdk-go#1812.

The SDK change is not released yet, so this draft intentionally keeps the existing SDK version in go.mod. Before this PR is marked ready, update it to the first released SDK version containing that change.

Testing

• go test ./cmd/auth ./libs/databrickscfg/...
• focused acceptance cases for group-id, group-id-rejection, and discovery-group-id in both Terraform and direct engine variants
• Python syntax checks for the browser helpers
• git diff --check

[eng-dev-ecosystem-bot]

Integration test report

Commit: 403cb10

Run: 32231772945

	Env	🟨​KNOWN	💚​RECOVERED	✅​pass	🙈​skip	Time
💚​	aws linux		3	79	11	0:53
💚​	aws windows		3	79	11	1:04
💚​	azure linux		3	78	11	0:57
💚​	azure windows		3	78	11	0:48
🟨​	gcp linux	1		79	11	1:23
💚​	gcp windows		3	79	11	1:28

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
🟨​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	🟨​K	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R		💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R		💚​R