Extend filtering into the identity backends wherever possible to improve scaling and performance

Filtering is currently done at the controller level, which means that for larger collections, the entire set of entities must be retrieved from the backend before filtering can occur. This leads to serious performance problems.

Filtering should be enabled in those backends that can use the underlying store (e.g. SQL, LDAP) to filter-at-source.