Implement SCIM 2.0 group provisioning and PATCH semantics correctly

Steps

1. Expose a /Groups endpoint supporting GET, POST, PUT, PATCH, and DELETE as specified in RFC 7644 sections 3.3 through 3.6.
2. Handle PATCH requests with a PatchOp body containing an array of operations; each operation has an op of add, remove, or replace and a path targeting the members attribute.
3. For add operations on members, append the supplied value array to the existing members list; for remove operations, delete members matching the filter in the path (e.g., members[value eq "user-id"]).
4. For replace on the members attribute, overwrite the entire members list with the supplied value array — do not merge.
5. Be aware that Microsoft Entra ID sends non-standard PATCH bodies when modifying group members, sometimes combining add and replace operations in a single request; handle both in your parser.
6. Return 200 with the updated Group resource or 204 with no body on successful PATCH; return 400 with a SCIM error schema body for malformed operations.