Disallow usernames or group names that have "system:" as group name

If the Identity Provider has groups with group names starting with "system:", the Pinniped Supervisor should not allow these groups to get cluster specific tokens/certs. For example, if there is a group called "system:authenticated" in the Identity Provider, members of this group will have privileged access to the cluster. Any cluster specific RBAC should be handled using Kubernetes RBAC and policies.

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Are you considering submitting a PR for this feature?

• How will this project improvement be tested?
• How does this change the current architecture?
• How will this change be backwards compatible?
• How will this feature be documented?

Additional context
Add any other context or screenshots about the feature request here.

No files, tests, or entry points are identified. Start by tracing how the Pinniped Supervisor maps identity-provider groups to cluster-specific tokens or certificates; done means groups and usernames beginning with "system:" cannot receive them, with coverage for the stated system:authenticated example.