CORE: Do not allow members with insufficient loa

- When creating member, check if he/she can be member by loa
  and vo membership expiration rules.

  If not - throw an exception which will rollback creation.

- Fixed test for membership extension, which must assert against
  INSUFFICIENTLOAFOREXTENSION.

- Skip creation of member on synchronization of group when
  we can't properly set membership expiration based on VO's rules.