PROV-835 OpenLDAP adapter now supports adding roles and groups based on LDAP group membership

These settings are only checked at user creation time but in most cases
that’s enough. We don’t ever revoke groups or roles. For now.