Allow to limit the group matching size.

Because a `contains` filter might return too many results. Causing performance issues.
Also allow to pass a block to the ldap searches.

/cc @mtodd