Add AD matching rule filter and more information

A customer and user in https://gitlab.zendesk.com/agent/tickets/80012 pointed out that our docs didn't mention that AD requires the special matching rule in chain filter to resolve recursive group members in the user filter. They also pointed out that it could be confusing that nested membership is supported in CE for user filter but group sync nested members are only in EE. I added a note clarifying this.