Fix/ldap username enumeration

[AugustoMagalhaes]

Summary

LDAPAuthentifier.login() returned different errors depending on why authentication failed. A missing or ambiguous user surfaced the internal lookup message (e.g. "Unable to find user X in base ..."), a wrong password returned "Invalid user or password", and a locked/disabled account returned "LDAP server is unwilling to perform: ...". These observable differences in the response let a caller infer whether a given account exists (CWE-204, Observable Response Discrepancy).

This change makes every credential failure return the same generic error, while keeping the specific reason in the server-side logs for diagnosis:

• a user that cannot be resolved (not found, or ambiguous match) now returns the generic "Invalid user or password" instead of the lookup message
• a locked/disabled account (server refuses the bind with unwillingToPerform) now returns the same generic error, with the real reason logged

A dedicated LDAPUserNotFoundError (subclass of LDAPAuthenticationError) is introduced so login() can distinguish the lookup failure and normalise it, without masking genuine operational errors (server unreachable, missing base DN, service bind failure), which keep their specific messages.

Tests

Added regression tests ensuring a missing/ambiguous user and a locked account both return the generic error, and that the bind is never attempted when the user cannot be resolved. Existing lookup tests were tightened to assert the dedicated exception type.

Notes

Reported privately to the maintainer beforehand; opening the PR as requested.