Backend/ActiveDirectory: let connection checker use a separate AD instance, make the checker optional

[jacobwod]

Documentation

To control whether a initial connection from the backend to the configured LDAP server is being attempted, use this setting in .env:

AD_CHECK_CONNECTION=true

It defaults to true when unset.

Original issue

I'm working on implementing two of the proposed changes that came up during today's meeting:

1. Make the #checkConnection method optional, the .env key will be called AD_CHECK_CONNECTION and default to true
2. Separate the connection checker ActiveDirectory instance from the main instance. The reason is that if the main instance has the LDAPJS option reconnect set to true, this check never fails (see Getting map config for restricted map can sometimes fail and return [ERROR] service.auth.v2 - read ECONNRESET #1320 (comment)). Using a separate instance, where reconnect: false; is hard-coded seems a safer approach.

Originally posted by @jacobwod in #1320 (comment)