_walk_group_ancestry() from LdapFluff::ActiveDirectory::MemberService can recurse in an infinite loop

[elatt]

It seems that our IT admins have created a cyclic group membership (where Group A has Group B as a member but Group B also has Group A as a member). While I doubt this type of configuration advised, it seems it is legal so I think _walk_group_ancestry() should have some sort of cycle detection otherwise it eventually blows up the stack and raises an exception. I propose that the function should be made tail-recursive by rather than returning a list, it should take a last and use that to accumulate data. Then I think we can check to see if the current group we are processing already exists inside our accumulated list of groups and if it does we know that we are starting to cycle and we can break out.