core: replace memberOf approach with reverse group lookup

all ldap implementations supports that, same performance level of
recursing or not recursing memberOf.

Active Directory to use global catalog for all group resolution,
using Microsoft specific extension.

result is simpler and more efficient especially for Active Directory.

Change-Id: Ic66b6e3472d2a1717d790c3a995305bc80b0b907
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>