Avoid LDAP searches that delay user-facing pages

I had a couple problems with this patch:

- The code at the beginning means this code is only executed once every 6 hours, no matter how often cron is run. It's already limited to running only when cron runs, which shouldn't be too often to hit a LDAP server. And it complicates attempts to fix a login if someone's account got blocked by confusing everyone about whether the LDAP credentials are broken or if the code just didn't run. I removed that restriction.
- The code pulls out a list of all users, then filters it using $authenticator->skipCheck($user), then checks to see if any accounts need to be unblocked. But that filter will remove all blocked users, so they will never get unblocked. I switched to use $authenticator->canAuthenticate($user->getUsername()) instead, which only filters out the anonymous user and user 1.

After thinking more on this, there might be times when you want to restrict how often this is done, not because of any worry about the LDAP server but to reduce the hit on Drupal. For instance, if cron runs very frequently and LDAP users rarely change. So I added a configuration value for and worked it back in.

A further tweak, add system messages to tell you who has been activated or blocked or that the update was skipped.