Group Membership: Consolidate assignments by resolved group first

[FriedrichWeinmann]

Groups to be assigned to can be identified by SID or Name or Placeholder
These will currently resolve to a different set of memberships each and accidentally generate delete actions.

Instead, each assignment group should be resolved first and the various labels consolidated into a single set of group assignments which can then be safely tested against.