Also, don't derive AdGroup from AdUser and list only valid group attrs

Add UpnSuffixConfig to allow for rich suffix config

Add option to ensure UPN suffix consistency

Closes #2

See merge request !1

This was introduced when higher-layers tried to default scope=None.

Adman is no longer just an ID assigner, so we need to make these more
specific.

This command should be the one command used from a cronjob to automatically
perform all auto maintenance tasks.

Several times I've seen "Server not found in Kerberos database", and it was
always because reverse DNS wasn't configured or wasn't working.