We broke saving nested LDAP groups with no members in 1.9 during the
conversion to ghost users. The attached patches fix that.
The first three patches would be nice to get into 1.9, the last patch is
OK in master only. I just found the code hard to read sometimes so I
split it into a separate functions and used more descriptive variable
names. I also think that the branch that the branch that re-read
SDAP_AT_GROUP_MEMBER after reading SYSDB_GHOST is not needed.