Change the creation of a user in LDAP to upon login

[matthias-ronge]

Part of #456.

The reason we have reversibly encrypted passwords in the database is that we want to be able to later create an LDAP entry for this user, which requires the password in plain text.

Goal: This change should pick up the password when logging in. Under the condition that

• the user has a password in the database,
• the user has an LDAP group,
• the LDAP group has an LDAP server,
• the LDAP server is writeable,
• the entered password is valid against the database password (i.e., not mistyped)

we use the entered password to create the user in the LDAP. If this was successful, a password (obfuscated or hash) is set to null in the database.

Rationale: This work is a prerequisite for replacing the reversibly encrypted passwords in the database with irreversible hashes, as the hash cannot be used to create a user in LDAP.