Auth: nested catalogs

[mind04]

Short description

"One catalog to rule them all"

Make it possible for catalog zones to be a member of an other catalog. A group property is used to signal if a member is a catalog.

And one commit to unbreak the regression tests for dynmodules.

Checklist

I have:

• read the CONTRIBUTING.md document
• read and accepted the Developer Certificate of Origin document, including the AI Policy, and added a "Signed-off-by" to my commits
• compiled this code
• tested this code
• included documentation (including possible behaviour changes)
• documented the code
• added or modified regression test(s)
• added or modified unit test(s)

[Habbie]

Code looks good. Perhaps the docs on catalog zones should explain a bit how the groups work?

One nit. One test breakage (repeated in many places).