Refactor `authenticateLDAP`

+ Add preliminary support for `ldap_group_map` configuration, which maps
  CA groups from LDAP groups, as an alternative to the existing `group_cn`
  config item, which is just a flat list of group names to look for in
  order to authenticate the user.
+ Fix LDAP connection code by removing unreachable conditions and adding
  correct check for connection errors.
+ Get rid of `ldap_base_dn` and `ldap_user_ou` config items, they were only
  used for substitution, which is now inlined.
+ Remove unwanted config from base config file.
+ Add TODOs for remaining work.
+ This is completely untested at this stage.
+ Make protocol version a config item (intended for future maintaining
  compatibility with current and next protocol versions).
Should we default to 'list' as this is how the current setup works?