fix: bound service account baseline permission checks

[henrysachs]

Summary

Follow-up for the baselinePermissions reconcile path added in #302.

This change makes the instance service account baseline permission flow safer and more stable under larger GitLab installations.

• bound per-group baseline permission API work with errgroup and a concurrency limit of 16
• propagate reconcile ctx into observe-side group membership checks
• sort missing and wrong-permission group IDs before persisting status
• forward request options in group fake clients so helper tests can assert ctx propagation
• add focused tests for deterministic status ordering and ctx-aware observe calls in namespaced + cluster controllers

Closes #310

Testing

• go test ./pkg/namespaced/controller/instance/serviceaccounts ./pkg/cluster/controller/instance/serviceaccounts

[markussiebert]

Rebased onto current master and resolved the conflicts (the branch predated the client-go/v2 migration and the Go 1.26 bump):

• gitlab imports client-go → client-go/v2 in the helpers/tests (namespaced + regenerated cluster mirror)
• test fixes to the v2 API: *gitlab.GetUserOptions (was gitlab.GetUsersOptions), v2.Available() (was xpv1.Available()), removed a now-unused cmpopts import
• golang.org/x/sync kept as a direct dep (errgroup), master's newer golang.org/x/* versions retained
• go.mod tidied, cluster zz_ files regenerated

go build ./..., full go test ./..., and golangci-lint v2.12.2 all pass locally on Go 1.26.4.

Review: the change looks good — bounded concurrency via errgroup (limit 16), mutex-guarded aggregation, g.Wait() before sort.Slice for deterministic status ordering, and ctx propagated into the per-group membership checks. One minor, non-blocking note: fetchTopLevelGroupsPage (ListGroups) doesn't propagate ctx, so a cancelled reconcile won't interrupt the group-listing pagination — could be a small follow-up.