ldap-sync: data.yaml collector

Patch

Fetches puppet's data.yaml from gitiles and extracts the four required POSIX groups. Gitiles base64-encodes responses; missing or malformed required keys abort the run.

Bug: T420691

Testing

From the ldap-sync subdirectory:

poetry run python3 -c "
import json
from ldap_sync.collectors.data_yaml_collector import fetch_posix_memberships
result = fetch_posix_memberships(url='https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/refs/heads/production/modules/admin/data/data.yaml?format=TEXT')
print(json.dumps({k: len(v) for k, v in result.items()}))
" | jq .