External group concept

It is about time to start thinking about how to implement external
groups.

As discussed earlier (see squid.sourceforge.net/ntlm/ for one achive)
two concepts are needed

 a) Groups as returned by the authenticator
 b) Other groups, verified by a separate helper using "ident/login, IP,
browser"

'b' is fairly straight forward to implement, but I am not very familar
with the auth code changes needed for 'a' but I guess it shouldn't be
too hard to add...

I think both should match a single ACL type "group" if possible.

--
Henrik