Store the original group DN in the subdomain user object
    
    For user of the local domain the server-side DN of the groups the user
    is a member of is stored with the user object in the cache and used to
    improve performance e.g. by the HBAC code. Since subdomain users should
    be handled by HBAC as well the group DN is stored in the same way as for
    users of the local domain.
    
    This patch also adds code to remove the attribute from the user object
    if the user is removed from the group.