Support API changes in Keycloak 23

[HappyTetrahedron]

Summary

• GET /admin/realms/$REALM/groups/$ID no longer returns the full subgroup-tree
  • Turns out, this doesn't affect us here. We use the Search option to always search for a specific group. If the result is a subgroup, the endpoint still returns the full subtree with all parent groups included.
• GET /admin/realms/$REALM/groups no longer returns the complete group tree, it now only returns the top level groups
  • This is resolved by querying child groups for each group (similarly to how we already query members for each group), using the new child groups endpoint.
  • If that endpoint doesn't exist (returns a 404), the code does nothing, assuming that we're on an older Keycloak version which would've returned the complete group tree in the first place.
  • Child groups are not queried recursively. This isn't necessary, since we only consider the top 2 levels of groups anyway (any more deeply nested groups are ignored later on).

Checklist

• Categorize the PR by setting a good title and adding one of the labels:
  bug, enhancement, documentation, change, breaking, dependency
  as they show up in the changelog
• Update tests.

[bastjan]

Few nits, otherwise LGTM