[keycloak-user] filter group claim in token per client