gRPC API set groups on passwords

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Problem Description

storage.Password has a Groups field, but the gRPC API cannot set it. The Password message in api/v2/api.proto has only email, hash, username, user_id, and server/apiserver/passwords.go copies just those four into storage.Password. UpdatePasswordReq is narrower still, new_hash and new_username only.

Groups for local passwords were added in #4456 and work through the config file. A user created over the API authenticates but has no groups, so any relying party that authorizes on the groups claim treats them as unprivileged. That leaves the config file as the only way to manage users with groups, which requires a restart to change.

Proposed Solution

Add repeated string groups to the proto Password, copy it in CreatePassword, and add new_groups to UpdatePasswordReq. The storage field already exists.

Alternatives Considered

No response

Additional Information

Willing to contribute the PR if feature request is accepted.