Description of problem:
An attempt to add to a Compliance (Puppet) Policy a Hostgroup without an Environment being set does fail:

hammer> policy update --id 1 --hostgroup-ids 5
Could not update the policy:
Internal Server Error: the server was unable to finish the request. This may be caused by unavailability of some required service, incorrect API call or a server-side bug. There may be more information in the server's logs.
hammer>

It does fail even when the HG inherits an Environment from a parent HG.

It affects just Policy with deployment type = Puppet / Ansible deployment type works fine.

Version-Release number of selected component (if applicable):
Sat 6.12

How reproducible:
100%

Steps to Reproduce:
1. Set up (Ansible and) Puppet SCAP content on your Satellite
2. Create a pair of parent+child Hostgroups
3. Create a Compliance Policies with deployment type Puppet
4. Assign the Policy to the parent HG:
hammer policy update --id 1 --hostgroup-ids 1
5. Set an Environment (common or production or any other) to the parent HG
6. Assign again
7. Ensure the child HG does inherit the Environment - in WebUI, editing the child HG shows "inherit parent (production)" (or what Env was set to the parent)
8. Assign the child HG to the policy
9. Overwrite the Environemnt of the child HG to whatever Env, even the same as the parent HG has.
10. Assign the child HG to the policy again
11. repeat steps 2 - 10 for a new pair of HGs and Policy of type Asnible

Actual results:
Steps 4. and 8. fail for Policy of type puppet
Steps 6. and 10. (when the HG does explicitly have an Env assigned) succeed
All steps succeed for Ansible policy type

Expected results:
All steps to succeed

Additional info:
Backtrace hit:
2023-03-24T13:27:01 [I|app|8ce8a58a] Started PUT "/api/compliance/policies/1" for 1.2.3.4 at 2023-03-24 13:27:01 +0100
2023-03-24T13:27:01 [I|app|8ce8a58a] Processing by Api::V2::Compliance::PoliciesController#update as JSON
2023-03-24T13:27:01 [I|app|8ce8a58a] Parameters: {"policy"=>

{"hostgroup_ids"=>[5]}

, "apiv"=>"v2", "id"=>"1"}
2023-03-24T13:27:02 [I|app|8ce8a58a] Authorized user admin(Admin User)
2023-03-24T13:27:03 [W|app|8ce8a58a] Action failed
2023-03-24T13:27:03 [I|app|8ce8a58a] Backtrace for 'Action failed' error (NoMethodError): undefined method `<<' for #<ActiveRecord::Relation []>
8ce8a58a | /usr/share/gems/gems/activerecord-6.0.6/lib/active_record/relation/delegation.rb:110:in `method_missing'
8ce8a58a | /usr/share/gems/gems/foreman_openscap-5.2.2/app/services/foreman_openscap/hostgroup_overrider.rb:24:in `add_config_tool'
8ce8a58a | /usr/share/gems/gems/foreman_openscap-5.2.2/app/services/foreman_openscap/hostgroup_overrider.rb:35:in `populate_overrides'
8ce8a58a | /usr/share/gems/gems/foreman_openscap-5.2.2/app/services/foreman_openscap/hostgroup_overrider.rb:16:in `block in populate'
8ce8a58a | /usr/share/gems/gems/foreman_openscap-5.2.2/app/services/foreman_openscap/hostgroup_overrider.rb:15:in `each'
8ce8a58a | /usr/share/gems/gems/foreman_openscap-5.2.2/app/services/foreman_openscap/hostgroup_overrider.rb:15:in `populate'
8ce8a58a | /usr/share/gems/gems/foreman_openscap-5.2.2/app/models/foreman_openscap/policy.rb:244:in `assign_policy_to_hostgroups'
..

The reason is /usr/share/gems/gems/foreman_openscap-5.2.2/app/services/foreman_openscap/hostgroup_overrider.rb:24:in `add_config_tool' :

def add_config_tool(hostgroup, klass, name, collection_method)
item = klass.find_by(:name => name)
hostgroup.public_send(collection_method) << item unless hostgroup.public_send(collection_method).include? item
item
end

The hostgroup.public_send(collection_method) is an empty ActiveRecord relation - one can check it via rake console any time, for either collection method (:puppetclasses for Policy type puppet or "ansible_roles" for Ansible):

irb(main):013:1* for i in 1..5 do
irb(main):014:1* puts("ID=#

{i}: #{Hostgroup.find(i).public_send(:puppetclasses).inspect}\n")
irb(main):015:0> end
ID=1: #<ActiveRecord::Relation []>
ID=2: #<ActiveRecord::Relation []>
ID=3: #<ActiveRecord::Relation []>
ID=4: #<ActiveRecord::Associations::CollectionProxy [#<ForemanPuppet::Puppetclass id: 1, name: "foreman_scap_client", created_at: "2023-03-23 07:24:01", updated_at: "2023-03-23 07:24:01">]>
ID=5: #<ActiveRecord::Relation []>

(here just HG ID 4 can be assigned to a Policy of Puppet type)

irb(main):025:1* for i in 1..5 do
irb(main):026:1* puts("ID=#{i}

: #

{Hostgroup.find(i).public_send("ansible_roles").inspect}

\n")
irb(main):027:0> end
ID=1: #<ActiveRecord::Associations::CollectionProxy []>
ID=2: #<ActiveRecord::Associations::CollectionProxy []>
ID=3: #<ActiveRecord::Associations::CollectionProxy [#<AnsibleRole id: 1, name: "theforeman.foreman_scap_client", created_at: "2023-03-22 19:01:56", updated_at: "2023-03-22 19:01:56">]>
ID=4: #<ActiveRecord::Associations::CollectionProxy []>
ID=5: #<ActiveRecord::Associations::CollectionProxy []>

Any HG can be assigned to Policy of Ansible type, despite the above output.

WORKAROUND: a tricky one: assign any dummy Environment to any affected HG, and unassign it back. Still the key records in hostgroup_puppet_facets PostgreSQL table will remain (even after the unassignment), causing the "public_send" method returns "#<ActiveRecord::Associations::CollectionProxy []>" / sufficient to use it.