s4-auth use new dsdb_expand_nested_groups()