Flag Former Students in the sync process

Once a student has graduated they tend to have strange entries in the
directory.  This adds a place for an LDAP query which will only return
former students and they can then be flagged that way so some mis-match
statuses will be ignored.
Students are never unfledged from this automatically, this has to be
done in the management console UI where they can also be flagged
manually.

Fixes #327