[FEAT] Further automation of "pending approval"

[sandrotanner]

app/Mail/PendingApproval.php
app/Http/Controllers/UserController.php

Making the groups for some of the bigger cantons be sent directly to the canton would be extra nice and more maintainable than an outlook rule.

Hint: The keycloak group is used to determine the canton, so if the group is AG, the data cannot be trusted, since in the past this was the default in the register form.