Allow arbitrary filtering of LDAP users

Currently, there is no way to filter LDAP login other than "ldap-username-attribute" and "ldap-user-base-dn". We need a way to filter LDAP authentication base on arbitrary criteria like group membership, thus the option will need to support arbitrary LDAP search filters.