Document roles/group.assumer for group rule sets

[gauthamsunjay]

Add the roles/group.assumer role to the documented roles for accounts/{account_id}/groups/{group_id}/ruleSets/default, and show it alongside roles/group.manager in the group rule set example. The role grants the Assume permission on a group, which underpins RBAC.

The provider passes grant_rules.role through to the API without validation, so no code change is needed.

Also fixes the group rule set example to reference the group through data.databricks_group.ds.id -- the block is declared as a data source, so the previous databricks_group.ds.id reference would not resolve.

Granting assume permission is in our customer docs - https://docs.databricks.com/aws/en/admin/users-groups/manage-groups#manage-permissions-on-a-group

Co-authored-by: Isaac

Changes

Tests

• make test run locally
• relevant change in docs/ folder
• covered with integration tests in internal/acceptance
• using Go SDK
• using TF Plugin Framework
• has entry in NEXT_CHANGELOG.md file

[github-actions]

Unit tests

If this PR is from a fork, the tests check runs offline against a pre-warmed Go module cache because fork PRs cannot authenticate to the internal Go module proxy.

If this PR changes go.mod or go.sum, the tests check will fail until a maintainer warms the cache for it:

Actions -> Warm Go Cache -> Run workflow -> pr_number = 5924

Re-run the failed check once the cache warming completes.

Integration tests

Integration tests don't run automatically for external contributors; an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/terraform

Inputs:

• PR number: 5924
• Commit SHA: 05d855a5856e16ca0dd58e476479188b9b682600

Checks will be approved automatically on success.