WIP Refactor `authenticateLDAP`

+ Add preliminary support for `ldap_group_map` configuration, which maps
  CA groups from LDAP groups, as an alternative to the existing `group_cn`
  config item, which is just a flat list of group names to look for in
  order to authenticate the user.
+ Fix LDAP connection code by removing unreachable conditions and adding
  correct check for connection errors.
+ Get rid of `ldap_base_dn` and `ldap_user_ou` config items, they were only
  used for substitution, which is now inlined.
+ Remove unwanted config from base config file.
+ Add TODOs for remaining work.
+ This is completely untested at this stage.
+ Make protocol version a config item (intended for future maintaining
  compatibility with current and next protocol versions).
Add to and remove from groups on every login based on config.

+ There is a config switch to enable automatic updating of group membership
  information on every login.
+ If the switch is on, whenever a user logs in, the group membership in CA
  is updated based on the group membership in LDAP.
+ Fix inverted logic issue in `userHasGroupLDAP` method.
+ Improve documentation in both code and stock configuration file.
+ Rename some configuration keys for clarity and consistency.
Re-add support for original configuration.

+ Major code refactor, breaking `authenticateLDAP` into smaller methods and
  improving documentation.
+ Sort out CN / DN issue with group names, and allow either to be specified,
  with a configurable "filter pattern" used to convert CNs into DNs filters
  for group searches.
+ Add an `ldap_group_match_method` configuration item, which specifies the
  "direction" of group matching.  ActiveDirectory supports user-to-group
  matching, meaning the list of groups is given in the user's attributes,
  others such as OpenLDAP only support group-to-user matching, meaning each
  group needs to be loaded and their attributes inspected to determine group
  matches.
+ Add an `ldap_attribute_membership` configuration item, which specifies the
  group attribute that contains user ids in group-to-user matching.
+ Change behaviour so that if `ldap_group_update_on_every_login` is enabled,
  `ldap_users_default_roles` and `ldap_users_default_groups` are applied on
  every login, in addition to the groups determined via LDAP lookups.
Merge pull request #99 from leftclickben/GR355-9769/GroupMatchingLdap

Refactor `authenticateLDAP`