DynamicSyncContext: avoid duplicate iteration in syncMembership

when dynamic-group option is enabled in addition the current code will iterate twice over the declared groups to populate the external principal names and to create the dynamic group accounts.

this should be improved such that resolving principal name from the given group ExternalIdentityRef objects and looking up existing group accounts is only performed once.