Enforce membership permission when creating users - #51458

tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java:526

• search(\"myadmin\").get(0) assumes the first hit is the intended user and that ordering is stable. To avoid nondeterministic failures, select the exact match (e.g., filter by getUsername().equals(\"myadmin\")) and assert it exists uniquely before using getId().

        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, adminPermissionsClient, "Only My Admin User Policy", myadmin.getId());

tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java:534

• The test creates two groups but doesn’t register cleanup for them, which can leak state across test runs and make failures harder to debug. Add cleanup entries to delete permittedGroup / unpermittedGroup at the end of the test (similar to the user deletions).

        GroupRepresentation permittedGroup = createGroup("permitted-group");
        GroupRepresentation unpermittedGroup = createGroup("unpermitted-group");

server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java:809

• The new overload makes group assignment dependent on the provided membershipHandler, but this isn’t obvious from the signature and is easy to misuse (e.g., passing a permission-check-only consumer and unintentionally skipping joinGroup). Consider adding Javadoc that explicitly states the consumer must perform the membership operation, or adjust the API to separate 'authorize' from 'join' to prevent accidental no-op group assignment.

    public static void createGroups(KeycloakSession session, UserRepresentation userRep, RealmModel newRealm, UserModel user) {
        createGroups(session, userRep, newRealm, user, user::joinGroup);
    }

    public static void createGroups(KeycloakSession session, UserRepresentation userRep, RealmModel newRealm, UserModel user, Consumer<GroupModel> membershipHandler) {
        Objects.requireNonNull(membershipHandler, "membershipHandler must not be null");