Add VirtualAttributes membership validator

First pass at getting a working Virtual Attributes membership validator working.

Will fail with ApacheDS because it doesn't support `memberOf`. Could fake it, though.

Pushed to see how the tests work with OpenLDAP though.

cc @jch