Use normal Plone groups

@adamcheasley @mattss Could you take a look at this fairly major change and let me know if it looks like it will cause problems for the Plone intranet project?

The gist of the change is that instead of workspace groups being looked up via a special PAS plugin that does catalog queries, workspace rosters now add people to normal Plone groups. This was motivated by performance (turns out looking up all the workspaces via the catalog can take a while if you have many workspaces, even if things are well cached; whereas with standard Plone groups it's just a single BTree lookup to find a user's groups).

There is an upgrade step to add the groups based on existing rosters.

I've been using this in production on my project for a number of months and the kinks seem to be worked out, but can't hurt to have another review!