make SearchControls configurable per authorization plugin

[vladak]

When thinking about how to make the LDAP searches more efficient w.r.t. server resources, I noticed that
LdapFacade#prepareSearchControls() uses SUBTREE_SCOPE which means it will return all object in the subtree. For searches coming from withing LdapUserPlugin it is expected that the base of the search will be set to fully qualified DN of the object therefore returning only one object, however the object might still have sub-nodes. In such case, it would be nice if the plugin can be configurable to use OBJECT_SCOPE instead (as per https://docs.oracle.com/javase/7/docs/api/javax/naming/directory/SearchControls.html).