bakery/example/idservice: generalise Privileged to group membership