Add support for rolling up group members when intermediary groups are not synchronized

[AFaust]

In some customer environments it may be desirable to exclude certain groups from synchronisation since they are "too technical" or exist only for the sake of meta structural reasons independant of the business organisation. In such cases the transitive membership of users to groups may be broken when the intermediary group is excluded in such a way. The LDAP synchronisation would benefit from an optional feature that allows rolling up group memberships to the next resolvable group in the transitive chain.