LDAP sync fails against Novell eDirectory: invalid attribute type distinguishedName-

### Is your feature request related to a problem?

I'm always frustrated when syncing users and groups from a Novell
eDirectory LDAP source fails with:

ldap3.core.exceptions.LDAPAttributeError: invalid attribute type distinguishedName

This happens because authentik/sources/ldap/sync/users.py and
sync/groups.py request ALL_OPERATIONAL_ATTRIBUTES in the LDAP search,
and sync/membership.py explicitly requests LDAP_DISTINGUISHED_NAME
("distinguishedName") as an attribute. Novell eDirectory does not
expose distinguishedName as a queryable operational attribute (unlike
Active Directory or OpenLDAP), so the search is rejected outright and
the entire sync fails.

### Describe the solution you'd like

I'd like authentik to have a way to sync against Novell eDirectory
without failing, ideally by:

1. Not requesting ALL_OPERATIONAL_ATTRIBUTES unconditionally in
sync/users.py and sync/groups.py, or making it configurable per
LDAP Source.
2. In sync/membership.py, not requiring distinguishedName as an
explicit attribute request, since authentik already constructs
the DN from the search result envelope elsewhere
(properties.setdefault("attributes", {})[LDAP_DISTINGUISHED_NAME] = dn).

This would let eDirectory-backed sources sync successfully without
custom patches.

### Describe alternatives that you've considered

I've tried this but currently run three local patches on top of the
stock images that we have to reapply on every authentik update:

1. Remove ALL_OPERATIONAL_ATTRIBUTES from the attributes=[...] list
passed to search_paginator() in sync/users.py and sync/groups.py.
2. In sync/membership.py, change:
attributes = [self._source.object_uniqueness_field, LDAP_DISTINGUISHED_NAME]
to:
attributes = [self._source.object_uniqueness_field]

This works reliably for our ~840 users / 70+ groups synced from
eDirectory, but isn't upgrade-safe.

### Additional context

Also note that this is common in German school IT environments
running Novell paedML/eDirectory (ZCM-managed school networks).
Happy to test a proposed fix against our environment if useful.

authentik version: 2026.5.x
Deployment: docker-compose
LDAP Source: Novell eDirectory

Start in authentik/sources/ldap/sync/users.py and sync/groups.py, tracing the attributes passed to search_paginator(), then inspect sync/membership.py where LDAP_DISTINGUISHED_NAME is requested. Compare these requests with the existing DN construction described in the issue. Done means an eDirectory-backed LDAP source can sync users, groups, and membership without the invalid attribute type error, while the existing LDAP behavior remains intact.

Written by the indexing model from the issue text.