Add ActiveDirectory membership validator

Adds an ActiveDirectory-specific strategy for membership validation, taking advantage of the "in chain" extended matching rule (documented here: http://msdn.microsoft.com/en-us/library/aa746475(v=vs.85).aspx).

No way to automate testing of this until we get an ActiveDirectory CI setup working reliably. Manual QA/testing for now.

cc @jch @github/ldap