fixes #7066 - add back $login interpolation for LDAP service account usernames

In cases where an LDAP connection is required outside of the context of user
authentication (e.g. validation of external user group name), an error is
thrown.  Users are recommended to use dedicated service accounts for this
new feature.

---

Wiki page for the new ERF code: http://projects.theforeman.org/projects/foreman/wiki/ERF42-9972.  I'll put something similar in the 1.6 release notes and manual.

The change to the authenticate? call that Leah mentioned in comment 3 of the bug report has been fixed with the UID lookup bit in https://github.com/Katello/ldap_fluff/pull/32 ([el6 scratchbuild](http://koji.katello.org/koji/taskinfo?taskID=143824)).
I'm pretty sure it used to always bind if necessary in these calls, but I tidied it up throughout in 0.3.1 to ensure it always would bind to the service account on any of the entry points.