Support multiple assignments to an SSO group

[cmbuckley]

This change adds support for multiple permissions assignments to a group. The most obvious example for this would be a developer account that has many permissions in lower accounts, but a restricted set in production:

module "sso_example" {
  assignments = {
    "Developer" = [{
      account_ids     = local.non_prod_accounts
      permission_sets = ["AdministratorAccess"]
    }, {
      account_ids     = local.prod_accounts
      permission_sets = ["ReadOnlyAccess"]
    }]
  }
}

With the current implementation the above scenario would require a user to be in 2 groups, which would be unwieldy and error-prone, especially since groups can't be nested in AWS or Entra provisioning.

This module was released a little prematurely - should probably have used a pre-release for the initial cut and get the feedback first. Unfortunately this will be a breaking change.