Add group configuration and auth validation

[mihaimitrea-db]

Summary

Adds group configuration and default-auth validation for group role assumption. This is the first of two stacked PRs and mirrors the configuration/validation boundary used by the Go Mod SDK.

Why

The SDK needs to resolve a requested group from supported configuration sources before OAuth credentials can request a group-scoped token. PAT and Databricks CLI authentication cannot assume a group, so allowing either strategy to silently ignore the setting would authenticate with the wrong identity.

This PR establishes the configuration and validation layer. The stacked follow-up, #308, adds assume_group to OAuth token requests.

What changed

Interface changes

• Adds Profile.groupId, mapped to DATABRICKS_GROUP_ID and profile key group_id.
• Adds M2mCredentialsOptions.groupId for the stacked OAuth implementation.
• Adds GROUP_ROLE_UNSUPPORTED to DefaultCredentialsErrorCode.
• Adds group-assumption capability metadata to default credential strategies.

Behavioral changes

• Default credential discovery skips PAT and Databricks CLI when a non-empty group is configured.
• Explicit PAT or Databricks CLI selection with a group fails before that provider is invoked.
• Empty group values preserve the existing credential strategy order.
• Default credentials continue to source configuration only from profiles and environment variables; explicit credentials are unaffected.

Internal changes

• Adds focused profile-resolution, credential-chain, and real CLI rejection tests.
• Adds a dedicated profile fixture for group configuration.
• Does not modify generated client code or dependencies.

How is this tested?

Passed the full repository checks:

• npm run format
• npm run lint
• npm run typecheck
• npm test
• npm run test:browser
• npm run build