Transition to a new servicegroup schema

Previously a service groups was dn: cn=local-morebots,ou=groups,cn=tools,ou=projects,dc=wikimedia,dc=org

In the future it will be dn: cn=tools.morebots,ou=servicegroups,dc=wikimedia,dc=org

This patch implement the latter schema but leaves in place the former.
This should let us transition ldap consumers gradually... once all the related
components are switched over we'll remove support for the older schema.

After this patch we continue to read from the old schema, but when writing
write to both.

Change-Id: Ib773c68c9c9ec174d3494b6bc27530c04e64037f
Merge "Transition to a new servicegroup schema"