[v9.4.x] LDAP: Fix user disabling

[gamab]

Backport f900098 from #74016
Backport 9e52414 from #73834

---

What is this feature?

In v9.x releases, LDAP users used to be disabled on login if they had been removed from the LDAP directory tree.
But we had a bug, we'd also disable non-ldap users.
In v10.x releases, with the move to the AuthBroker, we changed the approach and even if it's still impossible to log in with a removed LDAP user, we do not disable the user anymore.
This PR intends to restore the previous behavior in the AuthBroker but also fix the disabling to only target users that logged via LDAP.

Additionally, for large amount of ldap users (>500 users), active sync was only retrieving a single iteration of users (max 500 users) and therefore was disabling every user that wasn't returned considering them as deleted from the LDAP directory tree.

Why do we need this feature?

[Add a description of the problem the feature is trying to solve.]

Who is this feature for?

[Add information on what kind of user the feature is for.]

Which issue(s) does this PR fix?:

Fixes #

Special notes for your reviewer:

Please check that:

• It works as expected from a user's perspective.
• If this is a pre-GA feature, it is behind a feature toggle.
• The docs are updated, and if this is a notable improvement, it's added to our What's New doc.