Skip grant listing for empty Google Workspace groups

[c1-dev-bot]

Summary

• Adds SkipGrants annotation to Google Workspace groups with DirectMembersCount == 0 in the groupToResource() function
• When a group has no direct members, the SDK will skip calling Members.List() for that group, avoiding unnecessary API calls
• This prevents transient errors (e.g., TLS handshake timeouts) on empty groups from failing the entire sync

Background

An issue was reported where the Google Workspace connector was experiencing persistent sync failures. The root cause was TLS handshake timeouts when listing members for Google groups. The baton-sdk uses a fail-fast approach where one resource's grant failure stops the entire sync.

The Google Admin API's Group struct includes a DirectMembersCount field that indicates the number of direct members. By annotating groups with 0 members with the SkipGrants annotation, the SDK skips the Grants() call entirely for those resources. This reduces API call volume and eliminates a source of transient failures for empty groups.

Test plan

• go build ./... passes
• go test ./... passes
• Verify that empty groups are correctly skipped during sync
• Verify that groups with members still have their grants synced correctly

---

Automated PR Notice

This PR was automatically created by c1-dev-bot as a potential implementation.

This code requires:

• Human review of the implementation approach
• Manual testing to verify correctness
• Approval from the appropriate team before merging

[linear]

EPD-1604 Google Sync: Ignoring Empty Groups for Entitlements