Add groups option to cluster proxy (#297)

This change adds an option to specify groups a cluster proxy peer is a
member of.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added optional `spec.groups` to the ClusterProxy custom resource to
associate group references by `id`, `name`, or `localRef`.
* CRD schema includes OpenAPI validation to enforce that each group
reference specifies exactly one selector.

* **Bug Fixes**
* Improved deep-copy behavior for ClusterProxy spec so group references
are copied safely and don’t share underlying slices.

* **Documentation**
* Updated API reference docs and README API table to include the new
`groups` field.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

config/crd/bases/netbird.io_clusterproxies.yaml

@@ -57,6 +57,37 @@ spec:
                 x-kubernetes-validations:
                 - message: Value is immutable
                   rule: self == oldSelf
+              groups:
+                description: Groups are references to groups that the peer will be
+                  a part of.
+                items:
+                  properties:
+                    id:
+                      description: ID is the id of the group.
+                      type: string
+                    localRef:
+                      description: LocalReference is a reference to a group in the
+                        same namespace.
+                      properties:
+                        name:
+                          default: ""
+                          description: |-
+                            Name of the referent.
+                            This field is effectively required, but due to backwards compatibility is
+                            allowed to be empty. Instances of this type with an empty value here are
+                            almost certainly wrong.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    name:
+                      description: Name is the name of the group.
+                      type: string
+                  type: object
+                  x-kubernetes-validations:
+                  - message: Exactly one of id, name, or localRef must be set
+                    rule: (has(self.id)?1:0)+(has(self.name)?1:0)+(has(self.localRef)?1:0)==1
+                type: array
               serviceAccountName:
                 description: ServiceAccountName is a reference to the service account
                   used for impersonation.