feat: add security group membership with workload assignment, sg: prefix resolution in policy rules, and searchable select component

Add SecurityGroupMember model with security_group_id/workload_id foreign keys and unique constraint, implement security_group_members table with timestamps, add SecurityGroupMemberCreate/SecurityGroupMemberRead schemas with workload_name/workload_external_id fields, implement workload_provider_targets helper to expand sg: prefix into multiple workload targets with

backend/app/schemas/domain.py

@@ -127,6 +127,10 @@ class SecurityGroupCreate(BaseModel):
     description: str | None = None
 
 
+class SecurityGroupMemberCreate(BaseModel):
+    workload_id: str
+
+
 class SecurityRuleCreate(BaseModel):
     security_group_id: str
     direction: str = "ingress"
@@ -305,6 +309,15 @@ class SecurityGroupRead(OrmModel):
     project_id: str | None
     name: str
     description: str | None
+    members: list[dict[str, Any]] = []
+
+
+class SecurityGroupMemberRead(OrmModel):
+    id: str
+    security_group_id: str
+    workload_id: str
+    workload_name: str | None = None
+    workload_external_id: str | None = None
 
 
 class SecurityRuleRead(OrmModel):