Add a 'ldap trust ids' option that lets pdb_ldap check for posixAccount

Add a 'ldap trust ids' option that lets pdb_ldap check for posixAccount
attributes rather than calling getpwnam() on the user.

This should help fix some of metze's performance issues - particularly on
enumerations.

There is a consequential change to the operation of 'non unix account's in LDAP
- they are no longer restricted to being 'within' the NUA range, but will
always be added to that range.

Finally, there is the doco for this and the previous LDAP SSL changes.