Add visibility overrides for a group

Idempotently add visibility overrides for the group.

Per JSON:API to-many relationship POST semantics, this is idempotent: if a row already exists for the (group, published_course, is_visible) tuple, it is returned as succeeded — no separate already_exists error code.

Within-batch duplicate detection is first-wins on the (published_course_id, is_visible) tuple: the first occurrence is processed; subsequent occurrences are pre-marked duplicate_in_batch with the JSON:API source pointer at attributes/published_course_id.

Returns 404 if the group is not in the caller's organization. The group lookup runs before the envelope guard (empty / over-cap) so a missing group is always reported as 404 regardless of body content — clients can't infer group existence from the 400-vs-404 boundary.

Required OAuth scope: student-groups:write