Post-2.0.0: rework partial user/group search and richer enumeration (salvage from #67)

Tracking issue to rework the useful parts of PR #67 (*"add * also to beginning of query-value"*, @pbauer) as a clean, tested PR **after the 2.0.0 release**. PR #67 itself is closed/stale (conflicts with `main`, references the now-removed `six`, no tests), but it contains genuinely useful ideas.

### Scope to salvage
- **Richer `enumerateUsers` results** — include `email` and `fullname`/`title` in the returned dicts (currently only `id`/`login`/`pluginid`), reading them via `attrlist` and guarding missing attributes (`attrs.get("email", [""])[0]` etc.). This is the clearly-beneficial part.
- **Trailing `*` for group enumeration** — apply the same "append `*` if no exact match" partial-search behavior to `enumerateGroups` that `enumerateUsers` already has.

### Explicitly out of scope (do NOT just copy from #67)
- **Leading `*` (full substring `*value*`) search** — debatable: can be slow and over-match on large directories, and it is a behavior change. If wanted, make it an explicit, documented, opt-in option rather than the default.
- The stray `logger.debug(kw, matches)` line (incorrect logging usage).
- Anything touching `six` (removed in #144).

### Requirements
- Unit tests for the new enumeration fields and the group partial-search behavior.
- Confirm the extra `attrlist` attributes are optional and don't break configs where `email`/`fullname` are unmapped.

Relates to #67. Targeted for a release **after** 2.0.0.

Locate the implementations of enumerateUsers and enumerateGroups and their unit tests; first inspect how enumerateUsers builds attrlist and handles missing attributes. Add the requested email and fullname/title fields, apply the specified group partial-search behavior, and add unit tests confirming optional attributes and unmapped configurations remain safe.

Written by the indexing model from the issue text.