Ensure LDAP wildcards won't make it into the filter.

This fixes github/enterprise#980. Please see the issue for details.

/cc @github/enterprise-ops @github/security