Fix DRY_RUN aborting on users that do not exist yet

[tdewitt]

dryClient.CreateUser returns the user unchanged, so a user only pretended into
existence still has an empty ID. SyncGroups passed that ID straight to
IsMemberInGroups, which rejects it:

ValidationException: Value '' at 'memberId.userId' failed to satisfy
constraint: Member must have length greater than or equal to 1

The sync then died on the first group containing such a user, before evaluating
a single membership change. That makes DRY_RUN unusable whenever the Google
directory holds anyone Identity Center does not -- the normal state before an
initial sync, and precisely when a dry run is worth doing.

A user that does not exist cannot be a member of anything, so answer locally
instead of calling the API. Additions are still reported, so the dry-run output
stays complete.

Fixes #281.

#313 fixes the same failure more broadly: virtual IDs minted in the dry-run
shims, covering UpdateUser and ListGroupMemberships too, without touching shared
code. This change is deliberately minimal instead: one guard at the call site
that fails. The tradeoff is that it sits in SyncGroups rather than in the
dry-run shims, so it is on the path both sync methods run. Maintainers may
prefer #313's approach; happy to close this in its favour.