groups: add support for groups from oauth-challange

[InuSasha]

• reads the groups from a selectable oauth field
• create not existing groups at login as external group in the db

oauth has no possiblity to fetch the groups directly. this implies to create the groups at login and do not use an own GroupsBackend.