Function apply_session_template 

pub async fn apply_session_template(
    infra: &InfraContext<'_>,
    token: &str,
    session_template: Value,
    ref_lookup: HashMap<String, String>,
    target_groups: &[String],
    reboot: bool,
    dry_run: bool,
) -> Result<(BosSessionTemplate, Option<BosSession>), Error>

Apply a single SAT session_templates[] entry.

Fetches the caller’s accessible group list once; for non-admin callers validates that every group in target_groups is accessible, then passes the full list to the backend as hsm_group_available_vec. This consolidates the two get_group_name_available calls that the handler previously performed (one inside validate_user_group_vec_access, one to build the backend param) into a single backend round-trip.