Change IdentityResolvers to use ctx-independent ZetboxPrincipal class

Without this change, requests race on the underlying ctx when looking up
groups or try to access disposed context when the cache is refreshed.