Add an optional --allow-group flag restricting the daemon sockets (#7478)

docs/netbird.adml

@@ -56,6 +56,8 @@
 
       <string id="SplitTunnel_Name">Split tunnel</string>
       <string id="SplitTunnel_Help">Restrict the NetBird tunnel to or from a chosen list of application package names. Choose either the allow mode (only the listed apps route through NetBird) or the disallow mode (the listed apps bypass NetBird; everything else routes through). The mode is mutually exclusive — only one can be active at a time. Android-only at the daemon level; Windows/macOS/iOS clients ignore this policy.</string>
+      <string id="AllowGroups_Name">Restrict the daemon sockets</string>
+      <string id="AllowGroups_Help">Restrict the NetBird daemon control pipe, and the JSON socket where it is enabled, to the listed principals. Accounts outside them cannot connect at all, so nothing the daemon exposes is reachable from them; LocalSystem and elevated administrators are never locked out. Enter security identifiers in sid:S-1-5-21-... form, comma-separated, because the daemon reads this while starting and must not wait on a domain controller to resolve a name. An empty value lifts a restriction that was set when the service was installed.</string>
       <string id="SplitTunnel_Allow">Allow only listed apps (everything else bypasses)</string>
       <string id="SplitTunnel_Disallow">Disallow listed apps (everything else routes)</string>
 
@@ -101,6 +103,12 @@
         <decimalTextBox refId="WireguardPort_Decimal" defaultValue="51820">WireGuard UDP port:</decimalTextBox>
       </presentation>
 
+      <presentation id="AllowGroups_Pres">
+        <textBox refId="AllowGroups_Text">
+          <label>Allowed SIDs (comma-separated):</label>
+        </textBox>
+      </presentation>
+
       <presentation id="SplitTunnel_Pres">
         <dropdownList refId="SplitTunnel_Mode" defaultItem="0">Mode:</dropdownList>
         <textBox refId="SplitTunnel_Apps">