Type the membership APIs

Closes #1131 (closed)

The group management APIs were pretty simple to migrate, but the memberships were much more complex. I added a OneOf<…> helper from a StackOverflow comment to allow a XOR between different objects, so that you can list memberships for a corpus, or a worker, but not both a corpus and a worker at once, which the API does not allow.

I also noticed that the /api/v1/user/memberships/ endpoint, which only lists the user's groups and nothing else, uses the same serializer as for memberships but can have nullable attributes for reasons that are undocumented. The rights check for that one did not happen yet! backend#1246 (moved)