Allow assigning instance groups to inventory sources

[fernandorocagonzalez]

This comes from the forum thread https://forum.ascender-automation.org/d/17-feature-request-set-instance-group-of-inventory-sync (and upstream ansible/awx#13995, open since 2023 with no movement).

The problem

An inventory sync is a real job, the execution node spawns an EE and runs the inventory plugin inside it. So the node that runs the sync is the one that needs network access to the inventory source, not the control plane.

Today the only routing knob is Inventory.instance_groups, and it does double duty: it decides where playbook jobs using that inventory run AND where the syncs of that inventory run. The failure mode from the forum: your hosts live in a remote DC only reachable from an execution node registered there, so you pin the remote instance group on the inventory. As a side effect the syncs also get scheduled on that remote node, which has no route back to the central system the source pulls from, and the sync fails. There is no way to decouple the two.

You can work around it by setting the instance group on every job template and leaving the inventory alone, but that has to be repeated on every JT and a missed one silently falls back to a group that cannot reach the hosts.

What this does

Lets you assign instance groups directly to an inventory source. The resolution order for an inventory update becomes:

inventory_source.instance_groups > inventory.instance_groups > organization.instance_groups > global default

I went with per source rather than per inventory (which is what the forum post originally asked for) because one inventory can have several sources pointing at systems in different network segments. Per source degrades to exactly the per inventory behaviour when left empty, so it covers both.

A source with no instance groups behaves exactly as before, nothing changes for existing deployments. Playbook jobs ignore the new field entirely, it only affects inventory updates.

Implementation notes

The nice surprise is that InventorySource already inherits instance_groups from UnifiedJobTemplate, the field and the through table have been in the schema all along. The API just never exposed it and InventoryUpdate.preferred_instance_groups ignored it (there was even a comment in test_instances.py saying "API does not allow setting IGs on inventory source, so ignore those"). So this PR needs no migration at all.

• InventoryUpdate.preferred_instance_groups now consults the source first, then falls back to the existing chain. Same prepend semantics as job templates, and prevent_instance_group_fallback on the inventory keeps working as it did.
• New /api/v2/inventory_sources/N/instance_groups/ sublist, mirroring JobTemplateInstanceGroupsList, wired into the related links. Association order is preserved.
• RBAC: attaching needs use permission on the instance group plus admin on the inventory, the same rule as job templates, inventories and organizations.
• UI: instance groups lookup on the inventory source form (add and edit), labels on the detail view.
• Docs: docs/inventory_source_instance_groups.md.

Tests

• Updated the precedence test in test_instances.py (source set, source empty, and with prevent_instance_group_fallback).
• New parametrized RBAC test for InventorySourceAccess attach/unattach in test_rbac_instance_groups.py.
• Added inventory_source to the order persistence test in api/test_instance_group.py, plus an endpoint test checking the 403 without use permission and the 204 with it.
• Jest tests for the form, add, edit and detail screens.

Full functional suite and the UI tests pass, black/flake8 clean, check_migrations reports no changes.