Discover LDAP users server-side (fix #12511).

This PR fixes http://trac.openmicroscopy.org.uk/ome/ticket/12511.
1. User resolution should now be faster (we used to query the LDAP server for all matching LDAP users and then send the map to the server to use it in subsequent queries. That was suboptimal).
2. We lost the granularity of error reporting (before we had logic to decide if a user's DN is different in the DB or is null). Now we only notify the administrative user that DN mismatch happened and list the culprits.

To test:
- create some LDAP users in the OMERO DB (e.g using `bin/omero ldap create`) and some normal users (using `bin/omero user add`),
- try to change or remove the DN for LDAP users (using `bin/omero ldap setdn`),
- try to run `bin/omero ldap discover` - the reported users should be the same which had their DN changed/removed.

Also check if a security exception happens when you use the `discover` command as a non-root/non-admin user.
Because previous lines already assume the existence of "jack". It would be a bit misleading to ask the LDAP user to create an existing account.