Discover LDAP users server-side (fix #12511).

This PR fixes http://trac.openmicroscopy.org.uk/ome/ticket/12511.
1. User resolution should now be faster (we used to query the LDAP server for all matching LDAP users and then send the map to the server to use it in subsequent queries. That was suboptimal).
2. We lost the granularity of error reporting (before we had logic to decide if a user's DN is different in the DB or is null). Now we only notify the administrative user that DN mismatch happened and list the culprits.

To test:
- create some LDAP users in the OMERO DB (e.g using `bin/omero ldap create`) and some normal users (using `bin/omero user add`),
- try to change or remove the DN for LDAP users (using `bin/omero ldap setdn`),
- try to run `bin/omero ldap discover` - the reported users should be the same which had their DN changed/removed.

Also check if a security exception happens when you use the `discover` command as a non-root/non-admin user.
I'd probably have said "DN is missing or no longer matches" since it may not have been actively changed (in OMERO) or removed.