add a default group (reader/admin) to ldap settings

to allow ldap users be readers by default this lets you assign a permission group to each newly created user.
changing the default group later will not affect the newly created users (unless you can tell me a good algorithm on what permissions to keep)

issue Graylog2/graylog2-web-interface#437