Use authz.h/authz.lib for resolving user groups

[nilsbehlen]

Refactor group exclusion checks to use Authz API (Resolves AD nesting limitations and SAMR Error 5 blocks)

Overview & Symptoms

Currently, CCredential::CheckExcludedAccount relies on legacy NetApi32 functions (NetUserGetGroups and NetUserGetLocalGroups) to verify if a user belongs to an excluded group. This architecture is causing two distinct issues in production environments:

1. Active Directory Nesting Limitations: The current implementation fails to accurately parse and evaluate complex, nested Active Directory group structures.
2. Access Denied (Error 5) Blocks: Modern security baselines actively block remote SAM queries (specifically via the GPO: Network access: Restrict clients allowed to make remote calls to SAM). Because the legacy NetApi calls rely on the SAM Remote Protocol (SAMR), the local system's implicit outbound RPC calls to the Domain Controller are rejected. This causes NetUserGetLocalGroups to fail with Error 5 (Access Denied).

Root Cause

Both issues stem from relying on direct, network-dependent SAMR queries during the pre-authentication phase. The legacy API is unequipped to handle nested AD structures offline and triggers security blocks when attempting to resolve them over the network.

Proposed Solution

Deprecate the use of NetUserGetGroups and NetUserGetLocalGroups. Overhaul the group evaluation logic to use the modern Windows Authz API framework.

By translating the user and target groups into SIDs locally and generating a simulated client context via AuthzInitializeContextFromSid and AuthzGetInformationFromContext:

• We natively inherit Windows' ability to evaluate complex and nested group memberships.
• We bypass the restricted SAMR network endpoints entirely, preventing Error 5 blocks in hardened environments.

Acceptance Criteria

• NetUserGetGroups and NetUserGetLocalGroups are completely removed from the exclusion check logic.
• The implementation correctly identifies users who belong to the excluded group via a nested AD structure.
• Group evaluation succeeds without throwing Error 5 in environments where the "Restrict clients allowed to make remote calls to SAM" GPO is strictly enforced.