drastic speedup for nested ldap groups

resubmit of #8998 for @macjohnny 

I squashed the commits into one.

cc @blizzz