make ldap configuration sane

* don't break cs11 compatibility
* introduce tls_enabled, deprecate usage of 'encryption' setting
* re-add ssl_enabled which had been incorrectly removed.
* consolidate ldap settings validation and value generation
  into one place at private_chef#gen_ldap
* remove ldap_authentication_enabled from the template resource, should
  not have been there.