common/auth: add option to not use LDAP

This allows the off-site server to use the DB backup instead of LDAP for
passwd/group lookups. We get the following desired behavior:

- If firestorm is down, we can still do passwd/group lookups without
  waiting for the LDAP timeout
- nss_updatedb still properly pulls from LDAP to update the database, so
  all entries end up in the cache
- While firestorm is down, nss_updatedb fails loudly (rather than, e.g.,
  empty the database). This means that future lookups won't fail after
  the DB is upated.

Of course, it means that we only get new entries every time the local
cache is updated, but that's ok for our use.

I'll probably revert this in a couple weeks to remove complexity from
the puppet config (not totally decided, though -- in theory this could
be useful in the future, so it might be worth keeping).

I've disabled offsite's connectivity to LDAP (via a bogus hosts entry)
now, so that if there are problems, we should notice them (hopefully)
today or tomorrow.