feat: support full user targeting on workflow USER TASK

[engalar]

Fixes #169

Summary

• Parser now reads both legacy UserSource and current UserTargeting BSON fields, recognizing all five $Type variants (MicroflowUserTargeting, XPathUserTargeting, MicroflowGroupTargeting, XPathGroupTargeting, NoUserTargeting)
• Added MicroflowGroupSource and XPathGroupSource SDK types with full BSON serialization/deserialization
• MDL grammar extended with optional USERS/GROUPS modifier: TARGETING [USERS|GROUPS] MICROFLOW/XPATH
• DESCRIBE output now correctly displays all targeting types including group targeting

Syntax

-- User targeting (existing, backward compatible)
TARGETING MICROFLOW Module.GetUsers
TARGETING XPATH '[System.UserRoles = ''[%UserRole_Manager%]'']'

-- Explicit user targeting (new)
TARGETING USERS MICROFLOW Module.GetUsers
TARGETING USERS XPATH '[...]'

-- Group targeting (new)
TARGETING GROUPS MICROFLOW Module.GetGroups
TARGETING GROUPS XPATH '[GroupType = ''Reviewers'']'

Test plan

• 6 new parser tests covering all targeting types (user microflow/xpath, group microflow/xpath, no targeting, legacy UserSource)
• mxcli check validates all syntax variants
• Full test suite passes
• Build succeeds

[ako]

Clean fix with thoughtful backward compatibility.

What's good

Backward compatibility done right. Parser reads both legacy UserSource and current UserTargeting fields, mapping old and new $Type variants to the same SDK types — projects from any Mendix version round-trip.

Grammar extension is non-breaking. TARGETING (USERS | GROUPS)? keeps existing scripts working.

Full pipeline coverage across all 7 layers (SDK, parser, writer, grammar, AST, visitor, executor, formatter).

Good test coverage — 6 parser tests covering all targeting variants including the legacy field.

Concerns

XPathConstraint fallback may be reversed. Parser checks XPath first, then falls back to XPathConstraint, but the writer always emits XPathConstraint. If real Mendix BSON uses XPathConstraint, the XPath check is dead code; if both exist in different versions, the priority should match what's actually used.

Group source types may be missing fields. MicroflowGroupSource only stores Microflow. If group targeting has additional fields (e.g., context variable like user targeting may have), they'd be silently lost. Worth verifying against a real Studio Pro export.

MULTI USER TASK grammar duplication. Identical targeting blocks in both USER TASK and MULTI USER TASK rules — could be factored into a userTargetingClause rule. Not blocking.

Visitor's group detection is coarse. len(utCtx.AllGROUPS()) > 0 flags both microflow and xpath as group if either uses GROUPS. Probably impossible in practice (only one targeting clause allowed) but worth a guard.

No DESCRIBE roundtrip test. Tests cover parsing only. A test that creates → describes → re-parses would catch formatter mismatches.

LGTM — fix is correct, concerns are minor improvements.