Proposed fix for b/18028678.

1) No longer clear the "members" hashtable from between-crawl cache
2) When a new/modified user is detected by incremental crawl,
   if the (modified, existing) user had a different primaryGroupId last time,
   remove the user from that group, and add that group to the groups being
   pushed.
3) The existing code will push the updated membership of the new primaryGroupId,
   but as the cache is no longer being cleared, it will include the full
   membership information of the (new/same) primaryGroupId.
4) Split the "members" hashtable in GroupCatalog into two.  "members" will
   contain only members returned by AD search in the "members" attribute(s),
   while the new "primaryMembers" hashtable will contain group members that
   are determined by "reverse lookup" on each user's primary group.  When a
   group is modified (between a full/incremental crawl and the next incremental
   crawl, we take the new "members" attribute value and merge in the
   "primaryMembers" cached value to determine the full group's membership list.