Remove the "dn" column from "password" (fix #2587).

This is a set of conservative API/DB changes that aim to fix https://trac.openmicroscopy.org.uk/ome/ticket/2587. Removing the "dn" column is a first step towards a more resilient LDAP API that won't have to remember the DN for users coming from and LDAP server, and hence allow them to login if their DN changes.

To test the code changes:
- verify that all tests are green (travis, integration tests),
- try logging in with and LDAP user's credentials,
- try creating (`bin/omero ldap create`) an LDAP user and logging in as that user,
- check the output of `bin/omero ldap discover`,
- try using `bin/omero ldap setdn` and disable/enable and LDAP user (this will also work for regular OMERO users).

To test the DB upgrade script:
- try using a server without this PR, create LDAP users and move to the code with this PR included - run the DB upgrade script (`OMERO5.1DEV__11.sql`) and verify that all users still exist and you can log in as them
- the same test could be repeated with the 5.0.5 server as the starting point and then moving to 5.1DEV__12.

--no-rebase
Why not make it `required` and have many of the methods pass around a native `boolean`, avoiding fears of `null`s?