Detect appropriate membership validator strategy by default

This adds a meta strategy to detect the best strategy based on the server capabilities. The only real detection is whether the server is an ActiveDirectory supporting the "in chain" matching rule, otherwise we just default to the new recursive strategy.

Also adds a `membership_validator` configuration option to force a specific strategy (one of `:detect`, `:classic`, `:recursive`, or `:active_directory`).

See http://msdn.microsoft.com/en-us/library/cc223359.aspx for details on the ActiveDirectory capability detection. I'm struggling to find the reference now but from what I understand, the "in chain" matching rule is only supported as part of ActiveDirectory 2008 R2.

- [ ] docs
- [ ] tests (via mocks)
- [ ] manual test

cc @jch @github/ldap 

@jch the method is always called with an argument, which will be `nil` or `""` if no explicit option has been set, so the default here doesn't really kick in in practice. If anything, the default value could be removed, but here it's used to communicate that `nil` will be handled appropriately.