add support for group membership ACLs

[fixes #42383593]
[fixes #42161647]
[fixes #43174939]

Change-Id: I2b59a7e5c3fa6e8ceee4d63ed29d8e0c443b30ed