Configurable posixGroup membership filter support

Since some LDAP servers don't handle unknown attribute filter conditions gracefully (should I be surprised?), let's extract the posixGroup membership filter and conditionally apply it.

This branch enables it by default, but provides a `posix_support` configuration flag that can be set to `false` to disable its use.

This also largely changes `member_filter` back to its previous implementation, keeping the `entry` parameter in place of the `dn` parameter.