Add group domain class.

Search recursively for members and groups. Unoptimized version for LDAP
servers that don't support virtual attributes.

/cc @sbryant