Don't clean up groups for which a user has it as primary GID
We were cleaning up all groups that were expired and for which
there existed no user with memberOf: <thegroup> as an attribute.
This patch modifies the search to also check for cached users with
this group's GID as their primary GID.