Implement ephemeral groups

Part of #542 (closed). See: https://salsa.debian.org/freexian-team/debusine/-/blob/devel/docs/reference/devel-blueprints/experiment-workspaces.rst

• Add an "ephemeral" flag to Group, default to False (!1606 (merged))
• in regular maintenance, check for ephemeral groups with no roles assigned, and delete them (!1607 (merged))
• Add a function to create an ephemeral group for a user that:
  • creates the ephemeral group with a given name (!1606 (merged))
  • sets the user as a member of the newly created group (!1606 (merged))
  • (when we will allow users to manage group membership) sets the user as an admin of the newly created group (!1605 (merged), !1611 (merged))