When adding or removing groups on a user object, the merged permissions cache should be cleared.

In practice this is not usually a problem, as a user is usually mutated in the database and the permissions checked when a new request is made.

We ran into this problem when testing a custom permission system:

```PHP
$user->addGroup($group);
$this->assertTrue(Access::hasControllerPermission('SomeController', 'group_authorized_action', array()));
$user->removeGroup($group);
// This assertion fails without the pull request's changesets:
$this->assertFalse(Access::hasControllerPermission('SomeController', 'group_authorized_action', array()));
```