API: include_users=false on Groups endpoint still returns user PKs in users field

### Describe the bug

When calling the Groups API with include_users=false, the users_obj field is correctly set to null, but the users field still returns an array of user primary keys. The parameter name implies all user data should be suppressed, but it only controls users_obj.

With a large number of users per group, this causes API calls to be extremely slow and unacceptable for production use — defeating the entire purpose of the include_users=false parameter, which exists to improve performance.

### How to reproduce

1. Have groups with a large number of users
2. Call the Groups API with include_users=false:
GET /api/v3/core/groups/?include_users=false&ordering=name&page=1&page_size=20
3. Observe the response — users_obj is null (correct), but users still contains user PKs:
{
"pk": "a0ee26d1-1702-4adc-b143-e231cad5d3e7",
"name": "example-group",
"is_superuser": false,
"users": [92273, 94109, 94681],
"users_obj": null,
"attributes": {},
"roles": [],
"roles_obj": []
}
4. Notice the response time is significantly longer than expected, as the database still fetches and serializes all user PKs for every group

### Expected behavior

When include_users=false is set, both users (PK array) and users_obj should be empty/null. The users field should return [] or be omitted, just like users_obj returns null. The query should skip prefetching users entirely, resulting in fast response times regardless of group size.

### Screenshots

### Additional context

_No response_

### Deployment Method

Kubernetes

### Version

2025.10.2

### Relevant log output

```shell

```

Start by reproducing the Groups API request at GET /api/v3/core/groups/?include_users=false and inspect the Groups endpoint's serializer and query path. Done means the response omits or empties users, keeps users_obj null, and avoids fetching users when include_users=false; add or run the relevant API tests if present.

Written by the indexing model from the issue text.