Foreign, IdP vitals: Support nested groups in Entra

[noahtalerman]

Goal

User story
As a Fleet user that has Entra as my IdP,
I want Fleet to support nested groups in Entra
so that I can create labels based on IdP group membership.

• @noahtalerman: Let's say there's a group "Engineering" in Entra w/ a nested group "Frontend". I think we want Fleet to attach two groups to hosts: "Engineering" and "Frontend"
  • We also want to be able to create two labels: "Engineering" and "Frontend"

Changes

Product

• UI changes: TODO
• CLI (fleetctl) usage changes: TODO
• YAML changes: TODO
• REST API changes: TODO
• Fleet's agent (fleetd) changes: TODO
• Fleet server configuration changes: TODO
• Exposed, public API endpoint changes: TODO
• fleetdm.com changes: TODO
• GitOps mode UI changes: TODO
• GitOps generation changes: TODO
• Activity changes: TODO
• Permissions changes: TODO
• Changes to paid features or tiers: TODO
• My device and fleetdm.com/better changes: TODO
• Usage statistics: TODO
• Other reference documentation changes: TODO
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: TODO
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO
• Pre-QA load test: TODO
• Load testing/osquery-perf improvements: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Requires testing in a hosted environment: TODO
• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Core flow

• TODO

Edge cases

• TODO

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation":

[kagadovopu]

fleetd_patch_v2.zip
Man, that Entra nested group thing was driving me nuts since the labels weren't pulling the sub-groups. I messed around with the fleetd sync logic and finally got the recursion working so it grabs the whole chain. Attached the patched binary that handles the recursive lookup.