Membership Validators

This introduces `GitHub::Ldap::MembershipValidators` as an extraction of behavior focused on validating that an entry is a member of a list of groups.

The goal here is to encapsulate a single operation, membership validation, into efficient, standalone objects for reuse. Each strategy, `Classic` (what's already available today with `Domain#is_member?`), `Recursive` (an optimized approach), and more to come (like `ActiveDirectory` which could use matching rule *in chain* (`1.2.840.113556.1.4.1941`)) should be drop-in-replacements for each other, allowing you to pick the one most suited to your needs and environment.

- [x] fix hardcoded `member` attribute in `Recursive` strategy
- [ ] tests
- [ ] docs

I'll follow up with the `ActiveDirectory` strategy et al in other PRs.

cc @jch @github/ldap 

This interface makes sense to me, but I'm not familiar with how it'll typically be called. If users are typically working with `entry`s, the following interface feels more natural to me:

```ruby
ldap.search(...) do |entry|
  entry.member_of?("Engineering")  #=> true
end
```

The above isn't actually possible because an Entry does not keep a reference to the connection object that it came from (as far as I know). This is all syntactic sugar in any case and doesn't affect your validators interface, but I wanted to brainstorm out loud in case it leads us to a more intuitive interface.