Directory synchronisation retrieves all group memberships when synchronising an individual membership

When a user logs in to a delegated authentication directory we fetch their memberships. This process currently fetches details of the groups that user is a member of, rather than just testing for membership.

Improve performance by only testing for membership, taking into account nested groups and the different ways membership can be defined.