Group membership search in LDAP assumes user's dn starts with username attribute

Our group membership search doesn't pick up users in some LDAP configurations, most notably Active Directory. In AD, a user record and corresponding group record might look like this:

cn=jsmith,cn=Users,dc=example,dc=com
cn: jsmith
objectClass: inetOrgPerson
sAMAccountName: john

cn=confluence-users,cn=Groups,dc=example,dc=com
cn: confluence-users
objectClass: group
member: cn=jsmith,cn=Users,dc=example,dc=com

Confluence assumes incorrectly that the group membership for John Smith would be: smAccountName=john,cn=Users,dc=example,dc=com. Oops.

We should decouple the attribute used for the login name from the group search filter.