OIDC group check, production's denial text

As group-not-member, with restrict.to.group.error set to the text 19 production clients carry (grafana-prod among them). Shows the operator's text on the denial page with the code still in front: QA015: Sorry!, You're not authorized to access this client.

Expected

account \ verdictSAGBSA+vpnnone
exemptQA015QA015QA015QA015
not-exemptQA015QA015QA015QA015

Conditions now (read-only)

Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.

Sign in

Why

Custom text, code prepended, markup stripped: qa src/common/AccessDenial.java:38-44, docs/group-membership.md:47, docs/access-checks.md:110-115, README.md:86. Production's text: cfg environments/prod/prod-clients.yaml:146 (required_group_error_message becomes restrict.to.group.error, cfg modules/client/main.tf:134). Order and exemption as group-not-member.