Allow specifying additional FTP groups for login

Feature Requests
1

Piggybacking off NAS-135200 and having hand-backported it to ElectricEel-24.10.2.4 (apparently the commit was only for version 25).

Backstory

I finally had opportunity to try the fix and was largely satisfied until I realized that “Allow Local User Login” now really just meant “Allow anyone who can authenticate local or AD”, which wasn’t quite what I wanted.
Of course, toggling it off means “only ftp group users can log in”, which I haven’t been able to make the AD group sync with.

Problem/Justification

In theory proftpd will allow you to override Limit sections with later identical sections, but I wasn’t able to get this to work appropriately (e.g. a second Limit LOGIN section in the auxiliary parameters had no effect).

I solved this by adding to the proftpd.conf.mako template and not "<Limit LOGIN>" in ftp['options'] but this is funky since it assumes any limit login directives must mean the root limit login directive is specified, and I’m not certain if this is the case. I think it would be more elegant to provide a UI-based method to create that list

Impact
I think this is a QoL improvement for those trying to take advantage of AD groups and users specified by those groups for access control.

User Story
When adjusting advanced options in the FTP service control panel, instead of a “Allow local user login” toggle, a combobox captioned “Groups Allowed to Login” allowing selection of available groups (local and directory) is presented. When blank, placeholder text will display “Anyone can log in” or similar hint. By default, pre-selected ftp group is pre-populated.

Implementation

The two-part section in the proftpd.conf.mako template will be replaced with a simplified loop context that effectively covers both toggle states of the original setting, something like:

<Limit LOGIN>
% if ftp['onlyanonymous']:
    AllowUser anonymous
% endif
% if ftp['allowgroups']:
% for group in ftp['allowgroups']:
    AllowGroup ${group}
% endfor
    DenyAll
% else:
    AllowAll
% endif
</Limit>

(My python is rudimentary)

Migration would involve adding the new config field and inserting the ftp user if the Allow local user login toggle is not set.