Merge branch 'ldap_dont_remove_last_owner' into 'master'

Prevent LDAP from downgrading a group\'s last owner. Fixes #325

This should fix #325. I based it on the logic in !215 but optimized it a bit. I also added a new test and fixed an existing one that was prone to false-negatives. 

See merge request !216