Usernames containing '+' breaks group membership check

Symptoms

When using an LDAP directory, some membership operations fail if the username contains the '+' character. More precisely, REST calls to check if the user is a member of a group fail (for uncached directories), and attempts to remove the user from a group fail (for both cached and uncached directories).

Steps to reproduce

1. Set up an uncached LDAP directory in Crowd, e.g., OpenLDAP.
2. Create a user with a '+' character in its username.
3. Create a group.
4. Add the user to the group.
5. Navigate to the user, and try to remove the user from the group.

Expected result

User is removed from the group.

Actual result

User is not removed from the group, and an error message is shown.

Alternative instructions to reproduce the bug

For uncached directories, the bug also affects the REST query that returns if a user is a member of a concrete group, i.e., GET /crowd/rest/usermanagement/1/user/group/direct?username=user%2Bname%40atlassian.com&groupname=mygroup The query always returns 404 (MEMBERSHIP_NOT_FOUND), even when the membership actually exists.