Add support for external group mapping
There are currently two features that would like to populate roles/groups based on external identity/authentication providers:
- http://projects.theforeman.org/issues/813 for LDAP auth sources
- http://projects.theforeman.org/issues/3892 for Apache-based authentication
The two features share the generic need to manage mapping to external group names. This this feature to be able to agree on the generic solution, for each of the features to then add its protocol/approach specific code.