Refactor the LDAP user entry fetching from the actual importing of those entries

Internal code can now call _import_users separately with an arbitrary
set of LDAP user entries.

The cache reset is kept in import_users so that multiple internal calls
to _import_users (not that multiples exist yet) will populate the same
cache by default which should be safe and may save LDAP lookups during
group membership sync.
Optionally accept a scope parameter for _run_search, defaulting to 'sub'

When appropriate to the query, limiting the scope to 'base' or 'one' is
more efficient.

Subtree is the default of Net::LDAP and relied upon by all existing
queries.  Making it the explicit default is good for forward compat if
the Net::LDAP default changes.
Limit scope to 'base' when looking up a DN

The DN is the base so we don't need to query the entire subtree (if
any).
Optionally import group members before syncing membership

Adds the config option $LDAPImportGroupMembers.
Tests for $LDAPImportGroupMembers based on xt/group-import.t
Unset _ldap object after disconnect

Otherwise subsequent calls to _run_search will use the disconnected
object (to no avail) instead of connecting again.
Merge branch 'ldap-group-members'