GUI and LDAP implementation of service groups.

A 'service group' is a posix group that is local to a particular
project.  Service groups contain 'service users'.  The set of
service users will be given rights to tinker with a particular
tool or bot.

- Service groups are listed on the Special::NovaProject page
- New Service groups automatically contain a 'special' service
  user named after the group, as well as the creating user.
- Project admins can set a pattern for the homedir of these
  special service users.
- Members of a service group can add or remove other members.

This introduces three new config settings:

- $wgOpenStackManagerServiceGroupPrefix: Security groups are automatically
  prefaced with this, e.g. 'local-<secgroupname>'.
- $wgOpenStackManagerServiceGroupHomedirPattern: The default pattern used
  to create service user homedirs.
- $wgOpenStackManagerIdRanges:  An array that controls the range of gids
  used for service groups.

Change-Id: I43911178bd323e098c1d4df7a88556122141a22d