Think about changing how one tells BindAuthenticator which attributes to fetch

As requested, I am splitting the long and unclear #8560 into several issues. This issue is about (thinking about) changing how to tell BindAuthenticator which attributes to fetch.

I've described the behaviour in #8726. It's potentially confusing, and somewhat unergonomic.

Better behaviour

Have a single method the user can call to say "fetch these attributes" which works regardless of authentication strategy.

How to get better behaviour

Reverting 6b436ff409969 fixes this too, I think: it would mean that calling setUserAttributes always works. (Cf. #8727.)

You can also make setUserAttributes always work without reverting that commit, by having setUserAttributes modify the userSearch field which BindAuthenticator inherits from its parent class. If you do that, mention it in the javadoc for setUserAttributes.

Start by reading the behavior described in #8726 and the related discussion in #8727, then inspect BindAuthenticator, its inherited userSearch field, and setUserAttributes. Compare the proposed approaches, including the effect of reverting 6b436ff409969. Done means there is one consistent way to request attributes for each authentication strategy and the setUserAttributes documentation reflects its behavior.