Allow to add/remove group members by ID

for some cases it would be convenient if it was possible to add/remove group members by ID without having to retrieve the corresponding authorizable upfront... in particular for package imports as provided by jackrabbit fvault, where the group my be imported before the members are present.

similar it might be useful to remove dangling membership entries once a former member got removed.

the current implementations already allow for such a behavior when using an XML import run with the besteffort flag set for the import of the associated protected items (while failing in case of the other import-behaviour settings). such it would complete the API coverage for a feature we already support while at the same time control it based on the repository configuration.