added GroupDetailSelector so GroupPersistence implementation can configure whether group details should be returned from searches

implemented public-attribute-only get option so caller doesn't need permission to get a member group

add check timeout codes and throw TransientException; re-implement checkgroupExists as a filtered search instead of using getGroupNames

made modest retry for all transient failures the default in ca.nrc.cadc.net; improved some error handling for ldap timeout