Add resource groups and optional folder-scoped resources

### Summary
Add first-class resource Groups and (optionally) folder-scoped groups/resources.

### Motivation
Large Jenkins instances need isolation and delegation:
- Teams want to manage their own resource pools without global admin.
- Pipelines need to target a specific pool via `group` rather than a flat global namespace.

### Proposed pipeline DSL
- Keep existing behavior: `lock(label: "printer")` (defaults to global/common)
- New: `lock(group: "plc", label: "S7") { ... }`
- Optional (if folder scope included): `scope: "folder"|"global"`

### Data model
- `ResourceGroup { name, description, resources... }`
- Global config stores groups (migration needed)

### Folder scope (optional dependency)
Implement a folder property (like credentials scoping) holding groups/resources visible only within that folder subtree.

### Migration / compatibility
Automatic migration: existing resources moved into default group, with upgrade notes.

### Acceptance criteria
- UI can filter/select by group
- Pipeline `group:` affects selection deterministically
- Migration tests cover existing XML
- Folder-scoped resources (if implemented) are only visible to jobs in the folder subtree

### Tests
- Migration tests
- JenkinsRule tests for group selection
- If folder scope: JenkinsRule tests with folders hierarchy

### Docs
- Add examples under `src/doc/examples/`

Start by mapping the existing global configuration and resource-selection flow against the proposed ResourceGroup model and migration requirements. Add migration tests for existing XML, JenkinsRule tests for deterministic group selection, and, if folder scope is included, hierarchy visibility tests; document examples under src/doc/examples/.

Written by the indexing model from the issue text.