Fixes to support a group memberOf ldap filter

There are two changes here.  

First, lines 86-92 allow for the specification of an optional group_dn parameter that will allow for a bit more granularity when searching for a user in LDAP/AD so that you're not opening Chef to every entity in base_dn.  My original intent was to add far more granularity to the filtering, but the work involved was far beyond my skills (read: eldap has no magic function to convert a valid LDAP search string into the appropriate filter object).

Second, lines 161-164 handle down-casing the LoginAttr.  If this is not done and a mixed-case LoginAttr is provided, the proplists:get_value call on 166 will throw an exception, which manifests in the erchef log as a 504/Gateway Timeout.

This needs to be coupled with a change to the oc_erchef.config.erb template to add a 'group_dn' entry in the ldap section.  I'll be working on a separate pull request for that.

For testing, I compiled the changes and moved the resulting .beam it to the front-end nodes in a Chef 12 RC 6.1 HA cluster.  After adding the new config entry, reconfiguring, and restarting, I got the desired behavior when users logged in.  I also ran tests without ldap['group_dn'] configured, and logins worked 

I did try to add unit test coverage, but since there was no suite around ldap, I was in over my head.  This is my first foray into Erlang development, so please pardon any style errors.
for consistency with other proplists usage when we have no default, please use either get_value/2 or specify `undefined` rather than ""