Replace query to FAS with OIDC groups scope check.
    
    This removes our query to FAS and fixes #304.
    
    It is more flexible too, where we can now configure production to only
    allow in members of the `modularity-wg` group, and then later open it up
    to all packagers after F26 is out (as was agreed with FESCo).
    
    In the process of working on this, I discovered that #305 is not
    necessary.  We don't need our own scope; we can just use the `groups`
    scope as done here.