Don't embed memberships unless requested

This changes the way that memberships are embedded with the ?embed
parameter. If you just provide 'membership' then the first layer of
memberships are populated (the default behaviour), 'membership.person'
will populate the people in the first layer of memberships, but not
those peoples memberships, 'membership.person.membership' will populate
the people's memberships as well. The same goes for organizations.

I've changed the embed population to be a mongoose plugin, which
tidies up the code in src/app.js a bit to just call a method on the
model.

I've also removed the recursive membership population in favour of using
the async module, which makes it a bit easier for my brain to grok.

Fixes https://github.com/mysociety/popit/issues/634
This does mean that membershp.person.membership.organization ( not missing i in first membership ) work but not as expected as it doesn't match the first one. Possibly should check that the length of the matches looks right as well in the validation bit as a catch for this sort of thing.