Function validate_group_members_access 

pub async fn validate_group_members_access(
    infra: &InfraContext<'_>,
    token: &str,
    group_members_target_vec: &[String],
    hsm_groups_user_has_access: &[String],
) -> Result<(), Error>

Like validate_user_group_members_access but with the caller-accessible group list supplied explicitly.

Lets a caller that has already fetched hsm_groups_user_has_access reuse it across several membership checks without an extra round-trip. Admin tokens still short-circuit.