Replace CredentialsToLdapAttributePrincipalResolver with Generic ChainingPrincipalResolver

The new component, `ChainingPrincipalResolver`, supersedes the LDAP-specific
`CredentialsToLdapAttributePrincipalResolver`.

The new component is more flexible and easier to understand and document than the existing LDAP-specific component. `ChainingPrincipalResolver` will support the primary use case that the LDAP resolver presently supports, X.509 auth followed by LDAP principal resolution, and it could easily support related variations (X.509 -> Database) and others.