TLS Certificate Validation Disabled on LDAP Connection

## Issue: FINDING-084 - TLS Certificate Validation Disabled on LDAP Connection

**Labels:** bug, security, priority:medium, asvs-level:L2

**ASVS Level(s):** [L2-only]

**Description:**

### Summary
The LDAP client explicitly disables TLS certificate verification by calling `set_cert_policy('allow')`. This configuration allows the client to accept any certificate presented by the LDAP server, including self-signed or attacker-controlled certificates. A TODO comment indicates this is a known temporary configuration. An attacker positioned on the network path can intercept the TLS connection, present a self-signed certificate (which the client will accept), intercept authentication credentials (bind DN and password), and modify LDAP query results.

### Details
Affected location: `asfpy/aioldap.py` line 103

This affects all LDAP operations in the ASFQuart OAuth authentication flow. An attacker with network access between the application and LDAP server can:
- Intercept authentication credentials
- Modify LDAP query results (group memberships, user attributes)
- Perform authentication bypass

### Recommended Remediation
Enable proper TLS certificate validation.

**Option 1 (Recommended):** Require valid certificates with system CA trust:
```python
set_cert_policy('demand')
```

**Option 2:** Pin the specific Apache LDAP CA certificate:
```python
TLSSettings(ca_cert_file='/path/to/apache-ldap-ca.crt', verify_mode=ssl.CERT_REQUIRED)
```

**Option 3:** Use system CA bundle:
```python
import certifi
TLSSettings(ca_cert_file=certifi.where(), verify_mode=ssl.CERT_REQUIRED)
```

### Acceptance Criteria
- [ ] TLS certificate validation is enabled
- [ ] Self-signed certificates are rejected
- [ ] System CA trust or pinned CA is used
- [ ] Integration tests verify certificate validation

### References
- Source reports: L2:1.3.8.md
- Related findings: None
- ASVS sections: 1.3.8

### Priority
Medium