LDAP/AD integration improvements

This is a follow-up issue for #2980.

Two small additions:

mail attribute — would it be possible to make this configurable, or more flexible? We basically always use the UPN here, so the mail attribute is empty. Not a big issue, since I can write a simple script to periodically sync UPN → mail.

Predefining firewall groups — I'm using AD groups as firewall groups, which is amazing. I just can't predefine groups while they have no members, but that's not a big deal: for the initial sync I can just drop an example user into the group, then predefine the firewall rule for it. And if the group becomes empty later (AD-side, e.g. after I remove a user), the group stays in Defguard, which is great and keeps the group-based firewall rule intact.

I just hope this behaviour never changes. if the group got deleted in Defguard (and the firewall rule with it) just because there's currently no user in the AD group, I'd have to redo firewall rules over and over xD So just as a heads-up: please keep it this way. Or maybe a future option like "Sync empty groups" would improve the situation.