make ldap config sane and don't break cs11 compatibility

WIP - testing still in progress. 

ping @opscode/server-team 

So @kwilczynski and I discussed this a bit and concluded that the removal of `enable_ssl` broke backwards compatibility with ldap configuration under EC11.  In addition, it's kind of confusing - the term `simple_tls` is not a meaningful one, but we used it to indicate ssl suppor. (This was a holdover from  net/ldap   we used in opscode-account, which apparently dubbed ssl 'simple-tls'). Further, we accepted a value of 'start_tls', but research so far shows that we ignored it if specified (further verification needed, but I do not *think* net/ldap supported this).

This change tries to simplify things: 
* deprecates the 'encryption' setting - since we're only ever using two values, having a freeform type makes no sense. 
* reinstate enable_ssl.  It will now work as it used to: if you specify it in configuration, we will make an SSL connection to the ldap  host from oc_erchef. 
* add enable_tls. If specified, we will upgrade to a secure connection via the STARTTLS command after establishing the connection to the ldap server 
* if enable_ssl is set, use standard default ssl port if  port is not configured
* permit 'encryption' values of 'start_tls' and 'simple_tls', but warn that they are deprecated
* fail if we see an unknown `encryption` value; or if both `enable_ssl` and `enable_tls` are specified (they are mutually exclusive). 

Another commit will be made to add changelog and release notes entries.

/cc @jamescott for incoming documentation and release notes changes