provision-group: Convert from CJS → ESM so it works again

Since Node doesn't provide a way to cleanly run ESM programs¹, I choose
what seemed like the least-bad workaround and renamed the file to use a
.js extension.  This goes against best practice for program names, but
at least this is an internal-level thing where the impact is more
limited.  We'll still have to go update our internal doc elsewhere to
refer to the new name.

¹ nodejs/node#34049

scripts/provision-group → scripts/provision-group.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /* eslint-disable no-await-in-loop */
-const {ArgumentParser} = require("argparse");
-const {
+import {ArgumentParser} from "argparse";
+import {
   CognitoIdentityProviderClient,
   AdminAddUserToGroupCommand,
   AdminCreateUserCommand,
@@ -10,13 +10,13 @@ const {
   AdminUpdateUserAttributesCommand,
   CreateGroupCommand,
   paginateAdminListGroupsForUser,
-} = require("@aws-sdk/client-cognito-identity-provider"); // eslint-disable-line import/no-extraneous-dependencies
-const fs = require("fs");
-const yaml = require("js-yaml");
-const process = require("process");
+} from "@aws-sdk/client-cognito-identity-provider"; // eslint-disable-line import/no-extraneous-dependencies
+import fs from "fs";
+import yaml from "js-yaml";
+import process from "process";
 
-const {Group} = require("../src/groups");
-const {reportUnhandledRejectionsAtExit} = require("../src/utils/scripts");
+import {Group} from "../src/groups.js";
+import {reportUnhandledRejectionsAtExit} from "../src/utils/scripts.js";
 
 
 const COGNITO_USER_POOL_ID = "us-east-1_Cg5rcTged";