Push strategy should remove from groups before adding to groups

[adobeDan]

When doing a run with --strategy push, we currently put users into the right groups before taking them out of the right groups. Because the entitlements of the groups may overlap, the result of this ordering is that users will lose the overlapping entitlement, which is probably not what the customer wants.

[adobeDan]

We have a customer reporting that this has affected them.