Guard against ldap_sync_last_sync_at being nil
If ldap_sync_last_sync_at is nil, then the LDAP group got into
an inconsistent state after the transition. Since it's possible
for ldap_sync_last_sync_at to be nil, we guard against this
occurrence and attempt to bubble up the error to the admin.