static IP/Subnet reservation for network groups

**Is your feature request related to a problem? Please describe.**
I'd like to segment one population of devices into a given subnet so that mapping IP address to group is easier and to avoid conflicts of static IP assignment (e.g. I want to reserve a subnet for devices that don't exist yet and have an external service allocate the specific device IP address during enrollment but before it's been fully provisioned on the network via defguard).

Additionally, it's useful to guarantee that this class of devices will never receive an IP address that defguard might otherwise hand out to a new device.

**Describe the solution you'd like**
Being able to specify for a network group that it can only allocate out of a given set of subnets. Attempts to assign a device to that group will guarantee that it's allocated a random IP out of the available subnet(s). Attempts to statically assign an IP address to a device in a network group that has explicitly "pinned" subnets that's outside that range is an error. Attempt to statically assign an IP address not in the network group to one that's pinned for a network group is an error as are overlapping subnets in different groups (or adding a device to two groups that have these pinned subnet requirements).

**Describe alternatives you've considered**
Pre-reserving the entire set of IP addresses for a /24 or /16 and letting the external service manage that. It gets pretty error-prone though to manage.

**Additional context**
#2495 is probably related for device groups specifically but this is a general groups feature I think.