Subject: get_user_permissions() returns empty for users with multiple groups, and ignores group-derived grants when a user also has a direct role assignment

Environment:
- Project: default / Environment: dev
- PDP: Cloud PDP (<https://cloudpdp.api.permit.io>)
- SDK: permit-sdk-python 2.8.3, Python 3.10.7

Issue 1 — multiple groups on one user breaks all permission retrieval
User x-i-a_test-multi-group is a member of two groups (developer, data_user). Each group individually grants working permissions when assigned alone (verified via x-i-a_test-developer, group developer only, and x-i-a_test-data-user, group data_user). But with both groups on the same user, get_user_permissions() returns {} for every resource instance touched by either group — not just a conflict on overlapping resources.

Example:
user: x-i-a_test-multi-group (groups: developer, data_user)
resource: scope_artifactregistry:x-i-a_artifactregistry_france
expected: [repositories_delete_artifacts, repositories_download_artifacts, repositories_upload_artifacts]
actual:   []

5 of 5 checks failed for this user across all its resource instances.

Issue 2 — direct role assignment on a user causes their group-derived grant to be dropped
User x-i-a_test-data-user has both a group (data_user) and a direct role assignment (run.builder on scope: france) in the same membership entry. The direct role's permissions (france scope) resolve correctly, but the permission granted purely through the data_user group (on a different scope, project_a) comes back empty:

user: x-i-a_test-data-user
resource: scope_storage:x-i-a_storage_project_a
expected: [buckets_get, buckets_list]   <- granted via group "data_user"
actual:   []

By contrast, x-i-a_test-direct-role (role only, no group) resolves correctly, confirming the role path itself works — it's specifically the presence of a group and a role together on one user that suppresses the group's grant.

Ask: Is this expected PDP behavior (e.g. groups + roles or multi-group not being additive/merged), a caching/propagation issue, or a bug in permission resolution? Happy to share full config (group->role assignments, membership.yml) and a repro script (config/auth/validate_permit.py) that reproduces both against our environment on request.