Add recursive_group_search_fallback option

Adds a `recursive_group_search_fallback` option that can be set `false` to disable the non virtual attribute based group membership search. The fallback can be very expensive / time consuming when run against large directories.

/cc @sbryant, @dbussink, @mtodd