Add GroupDependencySelector integration to CreateGroupUpdatePullRequest

[robaiken]

What's this PR doing?

This PR integrates GroupDependencySelector with CreateGroupUpdatePullRequest to fix the "superset problem" where group PRs were including dependencies outside the group's scope. The integration adds filtering after compilation to ensure group PRs only contain dependencies that belong to the group.

Anything worth calling out?

The filtering is implemented in the dependency_change method and gated behind the :group_membership_enforcement feature flag for backward compatibility. I tested the integration by mocking compile_all_dependency_changes_for to verify the correct workflow level.

How do we know it works?

All 5 new tests pass, confirming that filtering works when enabled and is bypassed when disabled. Existing functionality remains intact (68/68 operation tests pass), so group PRs will now correctly include only dependencies that match the group's criteria.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.