LDAP user sync bugs in webserver auth mode

Nobody has claimed this yet.

When matomo authenticates users with LDAP + webserver auth (users in LDAP do not use passwords)...
```
[LoginLdap]
servers[] = "myldap"
use_ldap_for_authentication = 0
synchronize_users_after_login = 1
enable_synchronize_access_from_ldap = 0
[...]
use_webserver_auth = 1
[...]
enable_password_confirmation = 0
````
...every successful UI request is updating users record in SQL
```
UPDATE `user` SET `email` = 'mail@here', `password` = 'new_random_pass_every_time_here', ts_password_modified = 'curr time here' WHERE `login` = 'login_here'
UPDATE user SET ts_password_modified = date_registered WHERE login = 'login_here'
```
Enabling DEBUG shows
```
DEBUG LoginLdap[2025-03-03 18:04:43 UTC] [7854e] UserMapper::getPiwikPasswordForLdapUser: Could not find LDAP password for user 'login_here', generating random one.
DEBUG LoginLdap[2025-03-03 18:04:43 UTC] [7854e] UserSynchronizer::synchronizeLdapUser: synchronizing user [ piwik login = login_here, ldap login = login_here ]
```
Random password generation is explained on

https://github.com/matomo-org/plugin-LoginLdap/issues/212
https://github.com/matomo-org/plugin-LoginLdap/issues/204

Every LDAP sync job execution from cron...
```
php /var/www/matomo/console loginldap:synchronize-users --no-interaction --no-ansi
```
...also generates SQL user update commands like above (but this time password in updates is not changing).

Problems to be resolved:

1. Any user data sync from LDAP (i.e. after login if enabled, sync from cron job) should not generate any SQL update queries if users data in SQL and LDAP is the same to avoid wasting resources.
2. Matomo should not assume there are passwords used for auth (i.e. client certs may be used) when webserver auth is enabled. Matomo API should not require password column in user table to be nonempty and should not generate dummy passwords nor try to copy hashes from LDAP even if available there.
3. With `synchronize_users_after_login = 1` user LDAP sync should not be performed on every UI page change, but as name says once after login (new session creation).

Start by tracing LoginLdap's UserMapper::getPiwikPasswordForLdapUser and UserSynchronizer::synchronizeLdapUser, then run the loginldap:synchronize-users cron command to reproduce the updates. Check the webserver-auth login path as well as synchronization after login. Done means unchanged LDAP data causes no SQL updates, password handling is skipped when webserver auth is enabled, and synchronization runs once per login rather than on every page request.

Written by the indexing model from the issue text.