New macro for group handling, and group-handling examples in default config

This MR is mostly based on comments in #2036 (closed).

Groups remain confusing for many users, documentation is sparse and spread out. I think the best way to get our users started with groups is to show them how it's done in the default config.

This MR contains the following changes:

• A new, easy to use "inGroup" macro that tests whether the user is in certain groups. It's case-insensitive.
  • example: inGroup("admins") or $uid eq "mr-snowflake"
• A few example groups in the Demo backend
• Use of this macro in the default manager protection config

• A configuration that exports groups as a header in the demo vhosts, and that displays them in the demo app.

Perhaps there was a better way to implement the inGroup macro ?