(Collections) Initial collections work

Initial collections work.

TODO:

* Take care of some TODO's in the code
* Self-review
* Activity
* Searching collections (search permission integration is complete though)
I think we'll need to invalidate this cache appropriately in `_updateRoles` as well.

It might be useful to have a test that:
 * Creates a group hierarchy
 * Let getIndirectPrincipalMemberships cache the hierarchy
 * Update the group hierarchy
 * Assert a subsequent run of getIndirectPrincipalMemberships returns the updated hierarchy