This follows our usual backporting scheme, occurring e.g.
in #31468. We make the migration depend on the last migration in 10.x,
and create a merge migration to avoid having multiple leafs.
In #34510 we fixed the underlying bug in the ldap integration, which
would cause users to end up with their system group memberships not
matching their .role value. However, users who may already be in that
state still need to be fixed through a migration. We implement that
here.
There are two things we fix here:
1. Group memberships. The user should have a direct group membership
for the specific system group implied by their .role.
2. We want to also add the missing RealmAuditLog entry.
