[api] move the ldap code from user model to a class of its own

It has unfortunately 0 coverage, so I can't test it - but at
least I can filter it out and make sure the rest is covered well