Dynamic membership/group should spot conflicts with existing groups

during default membership synchronization collisions with existing groups that don't belong to the same IDP (or are local). the same logic should be applied when writing dynamic membership into rep:externalPrincipalNames and when resolving those principal names to dynamic groups.