make GroupDnResolver optional

Not all uses of the IDM User Manager care about Groups, so we shouldn't require unnecessary config.