s4:samldb - Major rework

s4:samldb - Major rework

This fixes up the change of the primary group of a user when using the ADUC
console:
- When the "primaryGroupId" attribute changes, we have to delete the
  "member"/"memberOf" attribute reference of the new primary group and add one
  for the old primary group.
- Deny deletion of primary groups according to Windows Server (so we cannot
  have invalid "primaryGroupID" attributes in our AD).
- We cannot add a primary group directly before it isn't a secondary one of a
  user account.
- We cannot add a secondary reference ("member" attribute) when the group has
  been chosen as primary one.

This also removes the LDB templates which are basically overhead now.

This should also fix bug #6599.