feat(gitlab): list the access tokens of all groups

[beliven-alex-zongaro]

Summary

GitLab has no UI to see all the group access tokens at once, so renewing them means opening every group and some get forgotten. New command:

opsi gitlab group access-tokens [--expiring <days>]

For every group with tokens it prints the group (path and URL) and, for each token, name, scopes and expiration:

acme/team (https://git.example.com/groups/acme/team)
  - ci-deploy [api, read_registry] expires 2026-10-26 (in 20 days)
  - old-token [read_api] EXPIRED on 2026-09-01 (35 days ago)
  - forever [api] never expires

• Revoked tokens are left out; groups without tokens are not printed. A summary is printed at the end.
• --expiring <days> shows only the tokens already expired or expiring within that number of days (tokens without expiration are not shown).
• Groups whose tokens cannot be read (no permission or error) are listed at the end instead of stopping the command.
• Needs a token able to read the access tokens of every group: an admin token with api and admin_mode is enough, no need to be owner of each group.
• The groups are checked 5 at a time, with progress on a single line.

Test plan

• go vet ./... and go test ./... (expiration formatting and filter, revoked tokens excluded, group with 403 does not stop the listing)
• Run on git.beliven.dev: 85 groups, 4 tokens, no errors. Cross-checked with a separate read-only curl/jq scan of the API: same groups, same tokens and expirations
• opsi gitlab group access-tokens --expiring 30

🤖 Generated with Claude Code