Check memberships recursively

Looks like we're not properly handling recursive group membership checks. Opening this PR with a failing test to set the state for a fix.

Skips trying `PosixGroup` unless it's enabled. It's on by default, so this doesn't result in changed behavior, just means we can disable this behavior at will.