Transition to a new servicegroup schema

Previously a service groups was dn: cn=local-morebots,ou=groups,cn=tools,ou=projects,dc=wikimedia,dc=org

In the future it will be dn: cn=tools.morebots,ou=servicegroups,dc=wikimedia,dc=org

This patch implement the latter schema but leaves in place the former.
This should let us transition ldap consumers gradually... once all the related
components are switched over we'll remove support for the older schema.

After this patch we continue to read from the old schema, but when writing
write to both.

(Note that a version of this patch was already merged and reverted; having a
second try.)

Change-Id: I5709b9056d77dcaaf1ab9145522cbd635ddfc0a3