Detect appropriate membership validator strategy by default

This adds a meta strategy to detect the best strategy based on the server capabilities. The only real detection is whether the server is an ActiveDirectory supporting the "in chain" matching rule, otherwise we just default to the new recursive strategy.

Also adds a `membership_validator` configuration option to force a specific strategy (one of `:detect`, `:classic`, `:recursive`, or `:active_directory`).

See http://msdn.microsoft.com/en-us/library/cc223359.aspx for details on the ActiveDirectory capability detection. I'm struggling to find the reference now but from what I understand, the "in chain" matching rule is only supported as part of ActiveDirectory 2008 R2.

- [ ] docs
- [ ] tests (via mocks)
- [ ] manual test

cc @jch @github/ldap 

Gotcha, it'd be nice if all enterprise configs normalized so we didn't need to do this, but out of scope here.