Do not allow administrators to set user `external` flag for LDAP users when `external_groups` is populated

LDAP group sync will managed LDAP users' external flag when external_groups are configured. This makes LDAP the single source of truth for external LDAP users. Currently, an admin can seemingly override/set the external flag the opposite of what LDAP says (enable or disable) but the next LDAP sync will override this. To improve user experience we should disable that field when editing a user if external users are managed by LDAP. (Also, disable this in the API in the same case).