Support SSL / TLS connections to LDAP servers

Secure connections to LDAP require a client-side certificate which is
used to confirm that the LDAP server really is who we expect it to
be. This patch adds support for --ldap_ca_certificate to tell LDAP where
that file is located.

Tested with both ldaps:// to port 636, and ldap://-over-TLS to port
389 (the latter with --ldap_tls).

Change-Id: I69e2a7c267bd471124ae9ccfd6fffca5d3d4f123
Reviewed-on: http://gerrit.ent.cloudera.com:8080/2401
Reviewed-by: Henry Robinson <henry@cloudera.com>
Tested-by: jenkins