support updating objectClasses for a User

This PR does a few things:

- moves existing deactivatedUid and new objectClass meta-data to a common implementation meta-data HashMap.
- implementation meta-data is not observed for object equality
- updates objectClasses based on current state of User object
- always updates objectClass on object update
If `!cn.contains("@")`, does that imply it is deactivated?