Support LDAP groups as claim

LdapClaimsHandler only supports attributes for the person entry. If the person entry doesn't provide an attribute for the list of groups, LDAP groups can be provided as claims.
Usually, the LDAP group entries contain an attribute (member or uniqueMember) which lists the DN of users belonging to this group.