fix(ldap-auth): key the consumer lookup on the escaped bind DN

[shreemaan-abhishek]

Description

ldap_authenticate() returns the bind DN it assembled as its third value, with the username escaped per RFC 4514 §2.4. The plugin discarded that value and rebuilt the same string by raw concatenation:

local user_dn = conf.uid .. "=" .. user.username .. "," .. conf.base_dn

The two forms diverge as soon as the username carries a character that has structural meaning in a distinguished name (, + = < > ; " \). An entry whose RDN value holds a comma binds against cn=comma\,user,ou=users,dc=example,dc=org, a single RDN, and is then looked up under cn=comma,user,ou=users,dc=example,dc=org, a two-component path. So the request either matches no consumer or matches one that belongs to a different directory entry.

This PR uses the DN the client already produced instead of rebuilding it, which keeps the bind target and the consumer key the same string by construction.

Backward compatibility: a consumer whose user_dn was written in the unescaped form to match the previous behaviour stops matching. This only affects directory entries whose RDN value contains one of the characters above, and the doc note added here spells out the escaped form to use. Every DN without those characters is unchanged.

Tests: the CI directory fixture gains an entry whose cn value is comma,user. Two cases assert that a consumer keyed on the escaped DN matches and one keyed on the raw expansion does not.

Which issue(s) this PR fixes:

Fixes #

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)