feature #3159: map AD groups to ONE groups in ldap driver

Generates mapping file and returns a list of IDs of ONE mapped groups that
the user should belong.
Feature #3159: Core gets group IDs from external auth drivers
Feature #3167, #3169: Make the restricted attr. mechanism generic for all pool objects
feature #3159: Added comments and replace rollback code
Feature #3167, #3169: fix compilation
Merge branch 'feature-3159'
feature #2796: Add LoginToken class to abstract token management both for sessions and tokens
Feature #3167: Allow users to edit their VNets, add vnet restricted attributes
feature #2796: Add login token to User object, the LoginToken is persistent
Add custom advanced section
Do not initialise forms
Set max width form right wizards
Remove deprecated function
Remove service template modal
feature #2197: Add Raw mode to service template wizard
Feature #3167: Allow users to edit their VNet's AR, respecting restricted attributes
Bug #3145: Pick the right instance type when multiple PUBLIC_CLOUDS sections are defined
Feature #3167, #3169: Fix replace_template for Zone
Small placeholder icon
Add advanced sections