Add ability to configure groups for the foreman user

Defaults to the correct values for the all-in-one case - split-setup
users will need to adjust this accordingly. I think this is better
than a bunch of `if defined ...` magic to try and detect the
presence of the `foreman::puppetmaster` class in the catalog