Add support for sudo groups

Ideally a user record will have groups attribute defined as an array of Strings. These will be the groups the user is a member of. 

Each instance should then have one or more tags defining which groups are allowed to login and which are allowed to sudo