Move building the LDAP filter into a subfunction

Move building the filter that we use to find the user's entry into a
subfunction, in preparation for giving it more capabilities.
When searching LDAP, filter on the certificate

When searching LDAP for an entry for a user, incorporate the contents of
the certificate in the filter that we send to the directory server.  Now
that we let the directory server look for entries with the certificate
in them, we don't need to walk the list of certificates in the retrieved
entry to check for matches, because the server says they're there.
Skip reading user certificates from LDAP

Since we're letting the server handle matching the user's certificate,
we don't need to bother with caching certificates that we've read from
the directory server.
Add an LDAP "uid_attribute", use it to speed up

Add an option to name an attribute of a user entry in the directory
server which contains the user name.  If it's specified, search for
entries that just match the certificate, and read the user name from a
matching entry.  If not, fall back to the old method of iterating
through all user names to find an entry that matches both the user name
and the certificate.  The first method should be faster.
Add "attribute_map" to LDAP mapping

Add an "attribute_map" list setting.  Items in the list take the form
"ldap_attribute_name=cert_attribute", where "ldap_attribute_name" is an
attribute that we'll name in a search filter, and cert_attribute is one
of "cn", "subject", "kpn", "email", "upn", "uid", or "cert".

When searching the directory, we'll try the configured map attribute
pairs before falling back to the traditional map: the attribute named by
the "attribute" configuration setting should contain the certificate.
Treat "attribute_map" as a list of ANDed clauses

As before, an "attribute_map" entry can specify a single LDAP attribute
and type of certificate data to compare it with.  Modify this so that a
list entry can include multiple clauses joined by an '&' character.
Merge pull request #6 from nalind/master

Changes (most of them optional) to how the LDAP mapper does matching