LDAP *: provision drupal roles to ldap "groups"

Where this code should go is unclear. Structurally it belongs in ldap_user since its for relationships between ldap users and drupal users. But ldap authorization drupal roles (admin/config/people/ldap/authorization/edit/drupal_role) defines the relationship between ldap and drupal roles.

For usability, I would suggest
-- the configuration of the ldap group to drupal role relationship be in ldap_server admin/config/people/ldap/servers/edit/uiuc_ad since this relationship may be used in other ways besides provisioning ldap groups and is specific to an individual implementation.
-- the enabling of provisioning be in ldap_user

My rationale for keeping out of ldap authorization is:
- ldap_authorization_* may be based on ou or a derivative of ldap group dn
- ldap_authorization_* may not be in use in a site that provisions groups to ldap
- the d6 module ldap_groups was renamed ldap_authorization which doesn't indicate provisioning to ldap of groups

I think this would take:

• a reverse mapping from drupal role to ldap group dn. this would likely be stored in the ldap_server configuration since its ldap_server specific.
• a reverse mapping from drupal user to ldap dn. this already exists and is stored in a field attached to the user entity.
• a placholder user of some sort. I some ldaps you can't create a group with no members or remove the last member from a group. I assume this would be configurable to something equivalent to devnull. This ldap user would be added to all provisioned ldap groups.

I'm pulling this code out of head. When we get back to this, its at: http://drupalcode.org/project/ldap.git/tree/6c2857f6d9907207242daa984501...

If someone wants to finish this or needs it finished, let me know and I can give a jumpstart on where we were heading with this.