lava: Fix filtering of groups

Make the LAVA backend:

1. filter out groups that should be excluded from the claim
2. leave unmanaged groups on the LAVA side unchanged

In particular 2 is needed for a smooth transition. Currently permissions are managed with manually created groups, removing people from there before the managed groups have been set up would make people very, very, very annoyed.

This also adds some unit tests since they were completely missing before, and they helped me catching some other issues.