[stub] The concierge should automatically filter large group sets based on RBAC

Related to #557 and #558

Client certs max out at roughly 50k characters worth of group names:

1. 500 groups with 100 characters each
2. 1,000 groups with 50 characters each

We have no choice but to encode groups into the client cert itself, meaning the best we can do is try to filter down the group list somehow. One automatic approach would be to filter down based on RBAC, but this could be problematic for admission plugins that have special behavior based on group membership. We could be smart about how we filter down, i.e. by trying our best to include every RBAC referenced group + every "short" group until we reach the 50k character limit. We could also not start filtering until we hit like 10k group characters.

Raw data:

Success with: 57,395 characters for 571 groups (most of which were 106 characters each),
84,437 byte PEM client cert - ~63,328 bytes decoded - successfully obtained via TCR

Even at 2,500+ groups with 100+ characters each (413,406 byte PEM client cert successfully obtained via TCR),
everything other than using the cert against KAS (i.e. Kube secret storage, supervisor OIDC, TCR, etc) worked just fine

// probably caused by this go std lib TLS limitation
maxHandshake       = 65536        // maximum handshake we support (protocol max is 16 MB)

sessions.yaml

No implementation file or test is named. Start by reviewing related issues #557 and #558 and the sessions.yaml data, then identify how group claims enter client certificates and how RBAC-referenced groups are represented. Done would require an agreed filtering policy and tests for the 50k-character boundary, but the issue does not define that policy.