support updating objectClasses for a User

This PR does a few things:

- moves existing deactivatedUid and new objectClass meta-data to a common implementation meta-data HashMap.
- implementation meta-data is not observed for object equality
- updates objectClasses based on current state of User object
- always updates objectClass on object update
basically I'm marking anything that is deactivated or not potentially a valid email as deactivated.

This was a quick fix for the fact that the email address facebook returns isn't always an email address. Our federation code allows a user to create an account based on the federated identity they logged in with, with Facebook once in a while (2-3 out of 2000 accounts) not returning a valid email I needed a quick way to filter them out of valid accounts.

That said, this is definitely not the right place for this check, setEmail should probably be the place we filter for valid emails. I'll deal with this in a different PR down the line.