NEXUS-5998: no need to (re)fetch group membership unless using static mapping (because with dynamic mapping the membership details are already populated)
NEXUS-5998: short-circuit LDAP role-search if none of the roles exist in LDAP
NEXUS-5998: only check role overlap with LDAP when using static mapping, otherwise with dynamic mapping we'd end up making two requests for all users