Re-add support for original configuration.

+ Major code refactor, breaking `authenticateLDAP` into smaller methods and
  improving documentation.
+ Sort out CN / DN issue with group names, and allow either to be specified,
  with a configurable "filter pattern" used to convert CNs into DNs filters
  for group searches.
+ Add an `ldap_group_match_method` configuration item, which specifies the
  "direction" of group matching.  ActiveDirectory supports user-to-group
  matching, meaning the list of groups is given in the user's attributes,
  others such as OpenLDAP only support group-to-user matching, meaning each
  group needs to be loaded and their attributes inspected to determine group
  matches.
+ Add an `ldap_attribute_membership` configuration item, which specifies the
  group attribute that contains user ids in group-to-user matching.
+ Change behaviour so that if `ldap_group_update_on_every_login` is enabled,
  `ldap_users_default_roles` and `ldap_users_default_groups` are applied on
  every login, in addition to the groups determined via LDAP lookups.