Prevent LDAP from downgrading a group\'s last owner. Fixes #325

Merged Drew Blessing requested to merge dblessing/gitlab:ldap_dont_remove_last_owner into master

This should fix #325 (closed). I based it on the logic in !215 (closed) but optimized it a bit. I also added a new test and fixed an existing one that was prone to false-negatives.