acl to allow nested groups in owner attribute
Almost as soon as I posted the question, I saw the dumb mistake I made -- I forgot to include the permission to be granted in the acl entry.  This entry is tested and works for users as owners, as well as groups and nested groups as owners (with a break-through so non-owners aren't rejected outright):

to dn.children="dc=Groups,dc=example,dc=com" by ssf=128 set="user &amp; this/owner" manage by ssf=128 set="user &amp; this/owner*/member*" manage by * break