users: Move part of LDAP setup to first-run
LDAP admin and basic structure setup requires running slapd. Move this to first-run so we don't have to start slapd during setup. This should avoid issues when running setup in a chroot.
This should fix the setup errors I saw in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851504. If this change looks ok then I'd like to make a quick release including it.