Implement Group extensions as proposed in JCR-3880

implement the API extensions proposed in JCR-3880.

my primary idea would be to:

• apply the same validation/logic as during xml-import and consequently use the configured protected-item-import-behavior to determine if members must exist in order to be added/removed using these calls.
• the cyclic membership would only be detected during the commit validation upon Root.commit() (needs tests if that works with pendent transient cyclic membership)

patch with tests with follow.