[cfid-495] group membership for bootstrap user should override by default

Actually the global override flag was working, but not if groups
were *removed*, so I added some code to do that and a test.

The override flag is scim.user.override (in uaa.yml).

[Fixes #42384505]

Change-Id: I5cc6016aff9dde8d0cdb2b125d74a1bae66446b1