feat: add remaining time and group names to grant status

[aaearon]

Summary

• Track elevation timestamps locally so grant status shows remaining session time (e.g., remaining: 45m) instead of total duration for sessions elevated via grant or grant env
• Resolve group names from the groups eligibility API so group sessions display Group: CloudAdmins in Contoso instead of Group: d554b344-uuid in 29cb7961-uuid
• Add remainingSeconds and groupName as additive omitempty fields to JSON output — existing consumers are unaffected

Backwards Compatibility

• Sessions elevated outside grant continue to show duration: Xh Ym (text) and omit remainingSeconds (JSON)
• Group sessions without name resolution fall back to UUID display
• FormatSessionOption callers (revoke, session selector) pass nil for new map parameters and get identical behavior
• New session_timestamps.json cache file is additive; existing eligibility cache files untouched

Test plan

• make test — all unit tests pass (new tests for session tracker, group name map, remaining time computation, status output, timestamp recording)
• make lint — no lint errors
• make build — binary builds cleanly
• Manual: elevate via grant, then grant status shows remaining time
• Manual: grant status -o json — remainingSeconds and groupName fields present for tracked/group sessions
• Manual: sessions elevated outside grant show duration (text), omit remainingSeconds (JSON)