fix(bluebubbles): add group chat filters

[skyc1e]

Adds chat-level filters to the BlueBubbles adapter:

• BLUEBUBBLES_IGNORE_GROUP_CHATS drops incoming group chat events before dispatch.
• BLUEBUBBLES_ALLOWED_CHATS limits handling to specific BlueBubbles chat GUIDs and also works as a group chat auth allowlist.

Docs and tests are updated for both env vars.

Closes #33489

Checked with pytest -o addopts='' tests/gateway/test_bluebubbles.py and git diff --check.

[teknium1]

Thanks for the focused BlueBubbles filtering work. The feature remains distinct from the merged mention gate: the maintainer comment on #35606 explicitly calls #33541 complementary.

Problems

• The group authorization additions target the old GatewayRunner path (gateway/run.py:6473 in this PR). On current main, that logic was extracted to gateway/authz_mixin.py:329-343 and :388-391; without porting the mappings there, the claimed group-chat auth allowlist is absent.
• The filters are applied at gateway/platforms/bluebubbles.py:952-963 only after attachment handling at :878-912, so ignored group traffic can still download and cache attachments.
• The new controls are documented as non-secret environment variables, while AGENTS.md:102-107 requires behavioral settings in config.yaml; current BlueBubbles group gating uses platforms.bluebubbles.extra in website/docs/user-guide/messaging/bluebubbles.md:45-64.

Suggested changes

• Port the authorization and unauthorized-DM handling to gateway/authz_mixin.py, move filtering before attachment retrieval, and cover an ignored attachment-bearing group webhook.
• Re-scope the controls to platforms.bluebubbles.extra and document that YAML surface.

Automated hermes-sweeper review.

[teknium1]

Current main extracted this authorization path into gateway/authz_mixin.py:329-343 and :388-391. Please port the BlueBubbles group-chat mapping (and the related unauthorized-DM allowlist handling) to that mixin; this old GatewayRunner edit will not implement the claimed authorization behavior on current main.

[teknium1]

This gate runs after the attachment loop above, so an ignored group message can still download and cache inbound attachments. Resolve the chat identity and apply the filter before attachment retrieval, with a test asserting the downloader is not called for an ignored group payload.