Membership Validators

This introduces `GitHub::Ldap::MembershipValidators` as an extraction of behavior focused on validating that an entry is a member of a list of groups.

The goal here is to encapsulate a single operation, membership validation, into efficient, standalone objects for reuse. Each strategy, `Classic` (what's already available today with `Domain#is_member?`), `Recursive` (an optimized approach), and more to come (like `ActiveDirectory` which could use matching rule *in chain* (`1.2.840.113556.1.4.1941`)) should be drop-in-replacements for each other, allowing you to pick the one most suited to your needs and environment.

- [x] fix hardcoded `member` attribute in `Recursive` strategy
- [ ] tests
- [ ] docs

I'll follow up with the `ActiveDirectory` strategy et al in other PRs.

cc @jch @github/ldap 

@jch I'm trying to move away from sugar like this for various reasons, but the biggest reason by far is that abstractions like this hide the actual work behind the scenes, which in this case means network IO.

I also don't want to try to inject methods like `member_of?` into `Net::LDAP::Entry` classes, keeping a clear separation between that library and these higher level concerns.