Escape user and group names when using AD filters.

We weren't escaping things before passing them into the ldap libraries, which
meant that trying to do something like an AD group named "C# Users" would cause
an error. This change makes use of ldap.filter.filter_format instead of raw
string formatting.

Fixes bug 2928.