graph: Always allow updates to "local" groups when LDAP

When GRAPH_LDAP_SERVER_WRITE_ENABLED=false still allow updates of groups
if a distinct GRAPH_LDAP_GROUP_CREATE_BASE_DN is configured.

Partial-Fix: #6219

services/graph/pkg/identity/ldap_group_test.go

@@ -161,6 +161,10 @@ func TestGetGroup(t *testing.T) {
 func TestGetGroupReadOnlyBackend(t *testing.T) {
 	readOnlyConfig := lconfig
 	readOnlyConfig.WriteEnabled = false
+	readOnlyConfig.GroupBaseDN = "ou=groups,dc=test"
+	readOnlyConfig.GroupCreateBaseDN = "ou=local,ou=group,dc=test"
+	localGroupEntry := groupEntry
+	localGroupEntry.DN = "cn=local,ou=local,o=base"
 
 	lm := &mocks.Client{}
 	lm.On("Search", groupLookupSearchRequest).Return(&ldap.SearchResult{Entries: []*ldap.Entry{groupEntry}}, nil)