Create locked accounts in Salsa for LDAP role accounts?

If starting reasonably in sync between salsa and LDAP is a goal, the strategy I outlined in here fails to keep role accounts into account. We can address that by creating locked accounts in Salsa corresponding to LDAP role accounts, before dropping the -guest requirement.

I personally switched to storing the authentication domain together with the username in all my code, and sso.debian.org also currently requires that for all the services that use it, so I fail to see much of a use case for this besides a need to document a change in expectations.