fix: getFieldsToSign crashes when user missing group/tab fields (#15775)

### What

Fix crash in JWT generation when user documents are missing group or tab
fields

### Why

When a user document was created before group/tab fields were added to
the schema, logging in would crash with "Cannot read properties of
undefined" because `getFieldsToSign` tried to traverse into undefined
fields.

### How

Added nullish coalescing (`?? {}`) to default missing group/tab data to
empty objects, consistent with how `afterRead/promise.ts` handles this
case.

Fixes #15734