Filter role mappings by visibility in group lookup by path - #54919

The tests were adapted to the existing 26.8 fixtures, which lack the upstream groupListings() helper and parent/child setup. The backport checks path-based lookup alongside the existing by-ID assertions, covering role visibility for manage-users, view-users, and fine-grained map-role permissions.

Coverage is narrower than upstream: nested paths and the inaccessible-parent 404 case are not included.

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest#createWebAuthnSameUserLabel

Keycloak CI - WebAuthn IT

org.openqa.selenium.WebDriverException: 
unknown error: unhandled inspector error: {"code":-32000,"message":"Node with given id does not belong to the document"}
  (Session info: chrome=156.0.8078.79)
Build info: version: '4.46.0', revision: 'df5a634 df5a6341cbb5f8f06b836bd595752775627c80dc'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '7.0.0-1019-azure', java.version: '25.0.5'
...

Report flaky test

Closed by #54630