Graylog ldap should not allow users that are not in groups to log-in

When setting a group filter for LDAP, Graylog defaults to reader for users that are not in any of the groups. There is no option to set this to none.

## Expected Behavior

Users that are not in any groups of the group filter should not able to login in, or a option to no access should be added.

## Current Behavior

A user that is not in any access groups can log in and is given reader access. security issue (in particular when they can view inputs etc..).

## Possible Solution

1. Add an option on the LDAP group page to disable access for "no group".
2. Don't use LDAP in Graylog

And no, memberof in the user search filter is not an option. Most large setups do not use this overlay.

## Context

A large LDAP setup does not generally provide a member of overlay; so the search filter is not the place to block group level access, the group filter is.
This renders the use of LDAP a security issue.
It becomed more problemetic if you combine it with SSO.
Users with SSO will get their user setup and access stomped over if they end up logging into LDAP as default reader when SSO is down, when in fact they should not be able to log-in at all as they are not in any groups (but are part of the LDAP directory).

In general, in the context of security, access should not be granted by any default value, and should have to assigned.

## Your Environment

* Graylog Version: 2.4
* Elasticsearch Version: 5.6
* MongoDB Version: 3.4
* Operating System: centos
* Browser version: chrome.