Validate that external roles are not used to compose other roles.

[ghenzler]

There are quite some problems that can happen if external groups (or better external roles, AEM groups that have externalId set) are used to build up other roles. Problems are

• If a role is open for adding member on AEM side, then roles show up in the members list
• IMS uses dynamic groups that can lead to javax.jcr.nodetype.ConstraintViolationException: OakConstraint0077
• In general it is good practice to clearly separate roles and fragments following https://github.com/Netcentric/accesscontroltool/blob/develop/docs/BestPractices.md#use-fragment-groups-for-functional-aspects-and-content-access

Therefore it should be validated that groups with externalId set are not used in isMemberOf clauses - if a configuration contains such a setup, an error should be thrown.