Add an egroup controller to expand groups used in rolebindings

Add an egroup controller to resolve egroups parsed from rolebindings. Whenever a rolebinding adds a new group that looks like an egroup, an egroup sync is triggered synchronously.

In addition to the controler, a cronjob resolves all existing groups again every hour in case there are new members.