Clarify LDAP group sync

This documents LDAP group sync details. When group sync is enabled, non LDAP users will not be removed. They may leave on their own. However, no one can add or remove users manually.

cc/ @balameb @axil