Handle Net::LDAP::Entry[] returning an Array, filter nesting

Since moving away from "entry.dn" to "entry['memberUid']", the filter
value was changing and breaking the filter generated.

Also, Net::LDAP::Filter can't handle generating a filter with more than
two filter conditions (aka "(|(one)(two)(three))"), so account for that.
Exclude memberUid members from Group#members

This explicitness prevents breaking behavior when calling super
for PosixGroup#members.

Not all membership names are created equal, it seems.
Test posixGroup with/out recursive fallback

Since this exercises two different code paths and needs
full test coverage.
Define posixGroup fixture data, schema
Use custom schema for posixGroup tests