group-based (memberOf) access profile synchronization

### Motivation
Current access profile demands changing ldap schema, which is very intrusive and almost impossible to change in bigger companies with stable ldap structures.

### Proposal
Proposal is to get user access profile based on memberOf: we should be able to define the view/admin/superuser/write profile via ldap groups, i.e: if user is memberOf "matomo-admins" group then user gets proper admin permission.

Start by tracing the plugin's current LDAP schema-based access-profile synchronization and how LDAP group membership could map to Matomo's view, admin, superuser, and write profiles. Confirm the intended group-to-profile configuration and define completion as users receiving the configured profile from memberOf groups without requiring LDAP schema changes.

Written by the indexing model from the issue text.