Function validate_sat_file 

pub async fn validate_sat_file(
    infra: &InfraContext<'_>,
    token: &str,
    sat_file: Value,
    target_groups: &[String],
    vault_base_url: &str,
    k8s_api_url: &str,
) -> Result<(), Error>

Pre-flight validate a SAT file against live CSM state without mutating anything.

Fetches the caller’s accessible group list once; for non-admin callers validates that every group in target_groups is accessible, then passes the full list to the backend. Same single-fetch consolidation as apply_session_template.