Support full SearchRestrictions on both entities in a MembershipQuery

A MembershipQuery in Crowd today is limited to a very simplistic model of querying on the name of one end of a membership, and only supports exact matches on those names. To make more complex single DB round-trip queries possible, we should add support in the MembershipQuery to allow both ends of the membership to have SearchRestrictions, allowing pattern matching across usernames, group names, user attributes, and group attributes.

We should add this support to CrowdQL, Crowd REST Client, Crowd REST Plugin, CrowdService and the underlying DAO level QueryTranslator.