Allow API edits to contact access on idp-managed groups

Problem
When a teammate group's membership is managed by an IdP (e.g., Okta, Entra), the group cannot be edited via the API at all. This prevents admins from controlling contact and contact list access without temporarily disabling IdP sync.

Request
Allow contact and contact list restrictions to be managed via the API for IdP-managed teammate groups, independent of membership sync.