don't read entire directory on --users mapped and --users group "..."

When a sync job is running on a subset of users in the directory, it may be a lot faster to just fetch the target users and not both reading the entire directory.  In fact, it's almost guaranteed to be faster, even if we have to do multiple queries (one for each group) and there's a lot of overlap.

So how about we only fetch the users we need in these cases?