Membership queries for user/group names end up fetching the underlying entity

Since configurable directory aggregation, searchNestedGroupRelationships promotes queries for String.class to queries for User.class or Group.class in order to get the directory ID.

For an RFC 2307 directory, this means that getting all memberships will make:

• One query to get all the groups
• One query for each group to get the members
• One query for each member

This can be implemented more efficiently to eliminate the final step.