Add allowedGroups check

[tomrf1]

The requiredGroups parameter is used to ensure a user is in all groups in the set.

It would also be useful to be able to check if a user is in at least one of the groups in a set.

This PR refactors the group checking logic in processOauth2Callback, to optionally support both:

• requiredGroups, with the existing behaviour
• allowedGroups, of which a user must be in a least one group