make GroupDnResolver optional

Not all uses of the UserManager require Group support, so let's make it optional
updated group value resolution to follow pre-existing pattern
test using a null GroupDnResolver