Membership Validators

This introduces `GitHub::Ldap::MembershipValidators` as an extraction of behavior focused on validating that an entry is a member of a list of groups.

The goal here is to encapsulate a single operation, membership validation, into efficient, standalone objects for reuse. Each strategy, `Classic` (what's already available today with `Domain#is_member?`), `Recursive` (an optimized approach), and more to come (like `ActiveDirectory` which could use matching rule *in chain* (`1.2.840.113556.1.4.1941`)) should be drop-in-replacements for each other, allowing you to pick the one most suited to your needs and environment.

- [x] fix hardcoded `member` attribute in `Recursive` strategy
- [ ] tests
- [ ] docs

I'll follow up with the `ActiveDirectory` strategy et al in other PRs.

cc @jch @github/ldap 

Going to reason about this a bit more. Haven't convinced myself how to this works yet.