Detect appropriate membership validator strategy by default

This adds a meta strategy to detect the best strategy based on the server capabilities. The only real detection is whether the server is an ActiveDirectory supporting the "in chain" matching rule, otherwise we just default to the new recursive strategy.

Also adds a `membership_validator` configuration option to force a specific strategy (one of `:detect`, `:classic`, `:recursive`, or `:active_directory`).

See http://msdn.microsoft.com/en-us/library/cc223359.aspx for details on the ActiveDirectory capability detection. I'm struggling to find the reference now but from what I understand, the "in chain" matching rule is only supported as part of ActiveDirectory 2008 R2.

- [ ] docs
- [ ] tests (via mocks)
- [ ] manual test

cc @jch @github/ldap 

By itself, not that I know of; it's more likely to be a problem due to misconfiguration. However, your point being that we should anticipate issues with this search are valid, we can default to a safe answer of "no capabilities" if anything unexpected happens.