Read group permission for fleet users

When a silo is created we accept a SiloCreate struct that defines an optional admin_group_name:

https://github.com/oxidecomputer/omicron/blob/ecb621455fc9e8c1fc4c6e952c73d4716c95f76f/nexus/types/src/external_api/params.rs#L301-L308

This group is created at silo creation time as described in the comment. We do not store this value though outside of the group instantiation. This makes it particularly difficult to debug silo IdP connections as groups are not visible to fleet viewers/admins. We've run in to this a few times internally on the preview rack as well as externally.

While we could store this value, it is really only useful for initial silo configuration, and not very useful in the long usage of the silo. Instead should we consider that silo groups be visible to users with fleet level permissions? We already allow for fleet permissions to list cross silo users, and view the opaque group ids via the policy endpoints. Is there a reason to prevent viewing the group display names?

Start with the SiloCreate definition in nexus/types/src/external_api/params.rs and trace the existing fleet permission and policy endpoints that expose cross-silo users and opaque group IDs. Determine the intended visibility rules for silo group display names and document or implement the chosen behavior with tests showing which fleet-level users can view them.