Any reason why the uniq can't be on name, auth_source_id, *and* usergroup_id, allowing the same external group to map to multiple Foreman groups?