core/groups: optimize prefetch queries to fetch only required fields (cherry-pick #18448 to version-2025.12)

[authentik-automation]

Cherry-pick of #18448 to version-2025.12 branch.

Original PR: #18448
Original Author: @joaocfernandes
Cherry-picked commit: e7903d5

[netlify]

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	48e31b0
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/6942e55ea1923700086e61d0
😎 Deploy Preview	https://deploy-preview-18914--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for authentik-integrations ready!

Name	Link
🔨 Latest commit	48e31b0
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/6942e55ebf91630008a7d306
😎 Deploy Preview	https://deploy-preview-18914--authentik-integrations.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.24%. Comparing base (fb7ab49) to head (48e31b0).
⚠️ Report is 1 commits behind head on version-2025.12.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                 Coverage Diff                 @@
##           version-2025.12   #18914      +/-   ##
===================================================
+ Coverage            92.91%   93.24%   +0.32%     
===================================================
  Files                  946      946              
  Lines                51951    51952       +1     
===================================================
+ Hits                 48270    48441     +171     
+ Misses                3681     3511     -170     

Flag	Coverage Δ
e2e	44.81% <100.00%> (+1.16%)	⬆️
integration	23.26% <0.00%> (+<0.01%)	⬆️
unit	91.49% <100.00%> (+<0.01%)	⬆️
unit-migrate	91.54% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-48e31b071de9892c9ae51acd78765deafa1d2d2a
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-48e31b071de9892c9ae51acd78765deafa1d2d2a

Afterwards, run the upgrade commands from the latest release notes.