[front] Store only the non-derivable group scope on the authenticator, resolve model tiers from principal groups

[front] Store only the non-derivable group scope on the authenticator, resolve model tiers from principal groups #37899