List security groups

Returns the security groups of the active tenant/subscription/project scope as a paginated collection. This single endpoint backs both the plain Security groups page load and every search/filter/sort/pagination control of that view: q performs a case-insensitive substring match against the group name and description, sort accepts the sortable columns name and created (createdAt) with order asc|desc, and page/pageSize window the result. Each row carries the full embedded rules array so the view can render inbound/outbound rule counts, plus attachedPorts for the "Attached ports" counter tiles. Soft-deleted groups (deleted_at set) are never returned. Validation: scopeId must reference a scope the caller can read → 403 otherwise; sort must be one of name|created → 422 VALIDATION_FAILED; page >= 1 and pageSize within the allowed window → 422; unknown region value → 422. Async & state: Synchronous read; no state change. Subsequent resource.updated SSE frames for security-group resources are merged into this cached list by the UI. Errors: 401 when unauthenticated; 403 when the caller has no role on the scope; 422 on malformed query parameters; 500 on read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required.