Add an audit-only mode for out-of-band group enforcement
Set AUTHZ_MEDIATOR_ENFORCE_GROUPS_AUDIT_ONLY=true
to test-run the
out-of-band group enforcement logic, so you get some time to review who
is going to be kicked out before actually turning it on.