Remove the "dn" column from "password" (fix #2587).

This is a set of conservative API/DB changes that aim to fix https://trac.openmicroscopy.org.uk/ome/ticket/2587. Removing the "dn" column is a first step towards a more resilient LDAP API that won't have to remember the DN for users coming from and LDAP server, and hence allow them to login if their DN changes.

To test the code changes:
- verify that all tests are green (travis, integration tests),
- try logging in with and LDAP user's credentials,
- try creating (`bin/omero ldap create`) an LDAP user and logging in as that user,
- check the output of `bin/omero ldap discover`,
- try using `bin/omero ldap setdn` and disable/enable and LDAP user (this will also work for regular OMERO users).

To test the DB upgrade script:
- try using a server without this PR, create LDAP users and move to the code with this PR included - run the DB upgrade script (`OMERO5.1DEV__11.sql`) and verify that all users still exist and you can log in as them
- the same test could be repeated with the 5.0.5 server as the starting point and then moving to 5.1DEV__12.

--no-rebase
I definitely had a reason to make it optional, when I started working on this PR. I'll have to dig again in my memories. On the other hand I can't come up with a scenario where setting this to required would break anything.