[Module Proposal]: `terraform-azuread-avm-res-pim-group`

### Check for previous/existing GitHub issues/module proposals

- [x] I have checked for previous/existing GitHub issues/module proposals.

### Check this module doesn't already exist in the module indexes

- [x] I have checked for that this module doesn't already exist in the module indexes.

### Bicep or Terraform?

Terraform

### Module Classification?

Resource Module

### Module Name

avm-res-pim-group

### Module Details

This proposal is for a PIM group, including the group, eligibility schedule, and role management policy.

It is connected to the proposal #2187 which includes the broader pattern for identity access management in an application landing zone.

Having this available as a separate resource would allow teams to make use of PIM groups as a building block (resource), if they wanted to deviate from the proposed pattern.

A proposed version of this is available here:
https://github.com/kewalaka/terraform-azuread-avm-res-pim-group

An attempt was made to use `msgraph` provider (to avoid the dependency on a hashicorp-owned provider), but was not successful due to existing issues, hence using `azuread` instead. The readme in the module links to details.

## Coverage of module from kewalaka

(from the readme)

The module supports the following as illustrated by examples:

- **Eligible Users** ("PIM for groups"). This is the recommended approach for most scenarios, where a group is permanently assigned the role and users are eligible to request access to this group. This provides per-user visibility for activation requests.

- **Group-Assignable**. In this approach the group is activated into the role rather than an individual user. This is not recommended except for specific circumstances (Microsoft recommend this approach for some M365 portals). Further details and a comparison with "PIM for groups" are in the example README.md.

- **Standard Security Groups**. Demonstrates PIM features on a standard security group (not role-assignable). This is suitable for Azure Resource RBAC scenarios where the group does not need to hold Entra ID roles.

## Status

- Passes all lint/grept checks as of today
- Comprehensive examples (E2E tests)

### Do you want to be the owner of this module?

No - I'm not an MSFT employee, happy to be secondary owner.

### Module Owner's GitHub Username (handle)

_No response_

### (Optional) Secondary Module Owner's GitHub Username (handle)

kewalaka