Respect users-only directory sync target on OIDC login

[danielheimburg]

Summary

• respect directory_sync_target=users during external OIDC login
• stop per-login group synchronization from overriding local group membership
• add a regression test for the users-only target path

Root cause

Periodic directory sync already respects the configured target and only syncs groups for all or groups.

However, the external OIDC callback unconditionally called sync_user_groups_if_configured, and that helper only checked whether directory sync was enabled, not which target was selected. As a result, logins through an external provider still rewrote group membership even when the provider was configured for users only.

Code evidence

• crates/defguard_core/src/enterprise/handlers/openid_login.rs: OIDC callback calls sync_user_groups_if_configured
• crates/defguard_core/src/enterprise/directory_sync/mod.rs: periodic do_directory_sync respects directory_sync_target
• this patch makes sync_user_groups_if_configured do the same

Testing

• added regression test for sync_user_groups_if_configured with DirectorySyncTarget::Users
• local test execution in this environment was blocked by protoc toolchain resolution during build, so the patch is code-reviewed but not fully executed here