groupserv: provide a hook for sasl_may_impersonate

This hook checks privileges for every group a user is in in the `impersonate:entity:` namespace.