ipagroup: Use PARAM_MAPPING and query state support

The ipagroup module has been reworked to use the new PARAM_MAPPING
added to ansible_freeipa_module.

The member handling for user, group, service and membermanager has
been simplified by using gen_member_add_del_lists. The member entries
in PARAM_MAPPING are now marked with "member": True. This replaces the
manual calls to gen_add_del_lists, gen_add_list and
gen_intersection_list across separate action/state branches with a
single unified call. externalmember and idoverrideuser are still
handled manually since they need SID-based comparison.

The new query state allows to retrieve group information from IPA.
The query_param option controls which fields are returned: BASE for
essential fields, ALL for all fields, PKEY_ONLY for group names only,
or a list of specific field names.

Here is the updated documentation of the module:

    README-group.md

New tests for the query state can be found at:

    tests/group/test_group_query.yml

tests/group/test_groups.yml

@@ -114,7 +114,7 @@
     ipagroup:
       ipaadmin_password: SomeADMINpassword
     register: result
-    failed_when: result.changed or not result.failed or "one of the following is required" not in result.msg
+    failed_when: result.changed or not result.failed or "At least one name or groups is required" not in result.msg
 
   - name: Name is absent
     ipagroup: