Membership Validators

This introduces `GitHub::Ldap::MembershipValidators` as an extraction of behavior focused on validating that an entry is a member of a list of groups.

The goal here is to encapsulate a single operation, membership validation, into efficient, standalone objects for reuse. Each strategy, `Classic` (what's already available today with `Domain#is_member?`), `Recursive` (an optimized approach), and more to come (like `ActiveDirectory` which could use matching rule *in chain* (`1.2.840.113556.1.4.1941`)) should be drop-in-replacements for each other, allowing you to pick the one most suited to your needs and environment.

- [x] fix hardcoded `member` attribute in `Recursive` strategy
- [ ] tests
- [ ] docs

I'll follow up with the `ActiveDirectory` strategy et al in other PRs.

cc @jch @github/ldap 

Not worried about answering that until it's actually needed, and the method/class signature might change enough to make this unnecessary. This is needed because this class uses `CN`s but the other uses `DN`s to compare, and I wanted to take `Net::LDAP::Entry` objects as input to make the input consistent between the two (drop in replacement being desired).