auth: Exclude resource groups from a TGT