cfid-552] Enable users to query groups where they are listed as readers

This makes the GET /Groups work as follows:
  1. For any token with scope='scim.read', response contains ALL groups that match the
     supplied search query
  2. For a user token with scope='scim.me', response contains groups that match the
     supplied search query AND that have the user listed as a READER
  3. 404 otherwise

Authorization around GET /Groups/<id> is unchanged.