fix(groups): include required label filter in transitive group search

[salmonumbrella]

Summary

• fix groups list Cloud Identity query to include required group labels predicates alongside member_key_id
• add a dedicated query builder with single-quote escaping for member IDs
• add regression tests to assert the exact query shape used by groups list

Why

Issue #304 reports gog groups list returning 400 badRequest: Request contains an invalid argument.

Cloud Identity searchTransitiveGroups now requires a query that includes both:

• member_key_id
• one or more label predicates ('...label...' in labels)

Previously, gogcli only sent member_key_id, which triggers the 400.

Fixes #304

Testing

• attempted: go test ./...
• result: fails due pre-existing compile errors on current main in internal/cmd/contacts_crud.go (unrelated to this PR)