Remove the "dn" column from "password" (fix #2587).

This is a set of conservative API/DB changes that aim to fix https://trac.openmicroscopy.org.uk/ome/ticket/2587. Removing the "dn" column is a first step towards a more resilient LDAP API that won't have to remember the DN for users coming from and LDAP server, and hence allow them to login if their DN changes.

To test the code changes:
- verify that all tests are green (travis, integration tests),
- try logging in with and LDAP user's credentials,
- try creating (`bin/omero ldap create`) an LDAP user and logging in as that user,
- check the output of `bin/omero ldap discover`,
- try using `bin/omero ldap setdn` and disable/enable and LDAP user (this will also work for regular OMERO users).

To test the DB upgrade script:
- try using a server without this PR, create LDAP users and move to the code with this PR included - run the DB upgrade script (`OMERO5.1DEV__10.sql`) and verify that all users still exist and you can log in as them.

Outstanding question for @joshmoore: If there are any API cleanups that could happen here, please let me know. One candidate would be the `lookupLdapAuthExperimenter(long)` method - I was thinking about changing it to `getDN` on `ILdap` to make the API more consistent. Open to suggestions.
Also, the patch number might have to be bumped (due to other PRs in the breaking queue).