Add test coverage for nested groups

[mackensen]

The code supports nested groups for both OpenLDAP and AD but there's no explicit test coverage.