s4-rodc: enable the DRS_GET_ALL_GROUP_MEMBERSHIP flag for RODC replication