LDAP sync can again remove a group's last owner

The problem in !7 (merged) was reintroduced by f9fd9372

LDAP group sync can leave a group without any Owner, which no one can manage anymore.