WebSearch: permitted restricted colls for guests

* Guests users might be authorized to view restricted collections
  by virtue of a FireRole specifying an IP address. For this
  reason the permitted_restricted_collections variable in
  intersect_results_with_collrecs() is now computed explicitly
  without using the precached_permitted_restricted_collections
  key of user_info which is only computed at login time.

Reviewed-by: Tibor Simko <tibor.simko@cern.ch>
BibCirculation: CERN LDAP improvements

* Improves handling of broken LDAP connections by retrying once
  more to connect and then giving up.

* Correctly escapes user input before using it in LDAP filters.

* Improves heuristic to discover CERN account corner cases, namely
  when a user left CERN and she still have a disabled account
  (identified by the "Primary" employeeType) and a new "ExCern"
  account.

* Removes no longer needed sleeping points.

* Reduces the number of calls to task_sleep_now_if_required() and
  task_update_progress().

* Improves progress report wording. (closes #1186)

Tested-by: Tibor Simko <tibor.simko@cern.ch>