nested transaction for createMemberSync

Nested transaction for membersManagerBl().createMemberSync

It fixes problem caused by 09add5b4748d229187b30d27f75008b65fec5094
(New Synchronizer workflow) - There is caught exception from
createMemberSync wich is not throw out. Therefore there is no rollback
and by that the inconsistency in database is made (member is created but
he is not in members group).
New authz for topGroupCreator

TopGroupCreator can call getCompleteRichMembers and getGroups

GroupManager can call this methods anyway and topGroupCreator can easily
create group and become groupManager

This is hack for eduGAIN group service - because miniapplication for
eduGAIN group service call this methods at start and not when they are
really needed.
Do not set role VO_OBSERVER in eduGain registrar module

Users in eduGain group service should not see other user's groups
Hack to add perunv3/admin@META as privileged user
All VO edugain_group members get groupManager of members group

Without that they can't see other members' preferred mails.
AuthzResolverBl.getPerunPrincipal calls refresh authz

It's important for external application / libraries to have up-to-date
authz for actor.