fix(argocd): match both bare and full-path group names in RBAC policy

[dcmcand]

Fixes #384

Problem

The data-science-pack rbac-bootstrap job reconciles the Keycloak group-membership mapper to full.path=true on every sync (JupyterHub needs full group paths for /shared/<group> mounts). Tokens then carry groups: ["/argocd-admins"] instead of ["argocd-admins"], the RBAC policy installed by ConfigWithOIDC stops matching, and with policy.default empty users lose all visibility in ArgoCD. See #384 for the full investigation.

Change

Map both the bare and slash-prefixed form of each group in policy.csv, so access works whether the realm-setup job (full.path=false) or the ds-pack bootstrap job (full.path=true) ran last:

g, argocd-admins, role:admin
g, /argocd-admins, role:admin
g, argocd-viewers, role:readonly
g, /argocd-viewers, role:readonly

ArgoCD's casbin g subject matching is exact, so the extra entries cannot over-match; whichever form is absent from the token is simply unused.

Testing

• go test -short ./... passes
• go vet ./... and gofmt clean
• Verified on the mystic.openteams.ai cluster: patching argocd-rbac-cm with these four lines restored app visibility for a user in argocd-admins with the mapper at full.path=true

Note for existing installations

Per the comment on the Config struct, upgrade-skip logic only compares chart versions, so this Values-only change will not reach already-bootstrapped clusters on its own. Existing clusters need either a chart version bump or a manual patch of argocd-rbac-cm (the mystic cluster is already patched).