Group Membership: Add local entities to root domain group

Currently, only groups for the current target domain can have their members updated.
This may require an option change in how group memberships are treated, to tolerate members from other domains in the same forest