chore(accesslogs): drop UserGroups field — nothing populates it

UserGroups on AccessLogEntry was a server-side enrichment artefact: the
proto AccessLog message never carried it, so the only writer was
manager.enrichUserGroups at save time. Without that writer the field
stays nil forever and the dashboard's user_groups column is always
empty — better to remove the dead surface than ship an unused field.

The dashboard can still reverse-resolve groups from UserId when it
needs them, accepting the tradeoff that memberships are resolved at
display time rather than captured at write time.

- AccessLogEntry.UserGroups field removed (no GORM column either).
- ToAPIResponse stops emitting the user_groups key.
- openapi.yml user_groups field removed; types.gen.go regenerated.
- enrichUserGroups + its test removed.

shared/management/http/api/openapi.yml

@@ -2896,11 +2896,6 @@ components:
           additionalProperties:
             type: string
           description: "Extra context about the request (e.g. crowdsec_verdict)"
-        user_groups:
-          type: array
-          items:
-            type: string
-          description: "Group IDs the user belonged to when the entry was written"
       required:
         - id
         - service_id

shared/management/http/api/types.gen.go

@@ -3786,9 +3786,6 @@ type ProxyAccessLog struct {
 	// Timestamp Timestamp when the request was made
 	Timestamp time.Time `json:"timestamp"`
 
-	// UserGroups Group IDs the user belonged to when the entry was written
-	UserGroups *[]string `json:"user_groups,omitempty"`
-
 	// UserId ID of the authenticated user, if applicable
 	UserId *string `json:"user_id,omitempty"`
 }