make GroupDnResolver optional

Not all uses of the UserManager require Group support, so let's make it optional
updated group value resolution to follow pre-existing pattern
test using a null GroupDnResolver
add abstract implementation meta-data field
move deactivated Uid into implementation meta
support tracking existing objectClasses and adding any required ones that are missing
always update objectClasses
relayAttributes should always be set on users
remove cruPersonAttributes if the user no longer has any of the Cru Person attributes
document that the *ImplMeta methods are for internal usage only