add mandatory schema items to local config object

Reorder/modify other things so that the local schema object is configured
first, then the whole thing is pushed to the LDAPUserFolder.

Fixes the bug where adding a new AD configuration would have the schema
items stored in the LUF but not config.schema, so they would only show up
in the ZMI, not Plone.
don't allow removing required attributes

Also adjust the docs to match and clean up/clarify them.

NB: removed the callback from HandleRemoved(), because the property is not
yet removed from config.schema at this point, and it was getting added back
to the LUF.

Preventing deletion of a mandatory property is a better solution than deleting
it and then immediately adding it back.
fix icon deprecation warning