Check memberships recursively

Looks like we're not properly handling recursive group membership checks. Opening this PR with a failing test to set the state for a fix.

The second assertion fails without explicitly downcasing `GROUP_CLASS_NAMES` in `Group#group?`.