Feature: Store directory extension attributes of groups in token.json

There are use cases to assign additional data to users and groups which should be accessible to admins of the local system. For example, @ajm370 wants to have shared user and group IDs on all systems using authd, and wants to achieve that by setting IDs via directory extensions, then read those once the user logged in and use authctl to change the user/group ID to the one from the directory extension (once authctl supports that). See https://github.com/ubuntu/authd/issues/630#issuecomment-2930695596 and the discussion following that comment.

The directory extension attributes of user objects can already be stored in the token.json file, by emitting them as claims in the ID token (which is stored in JWT format in the RawIDToken field of token.json): https://learn.microsoft.com/en-us/entra/identity-platform/schema-extensions

Directory extension attributes of groups are part of the group object which we already fetch via the Microsoft Graph API. A small patch is necessary to also store those in the token.json.

Start by tracing how user directory extension attributes are emitted as claims in the ID token and stored in token.json. Then inspect the existing Microsoft Graph group-object fetch path and determine where its extension attributes should be preserved alongside the RawIDToken data. Done means group directory extensions are available from token.json, with the relevant tests updated or added if the existing flow has coverage.

Written by the indexing model from the issue text.