docs(upgrade): say what changes for LDAP permission names in 15.8

[marevol]

What this adds

Two permission-name changes land on an existing LDAP / Active Directory
deployment when it upgrades to 15.8, and neither was written down. Both are now
in the "15.8-specific migration" section, in all seven languages.

1. Group and role permission names are read from the RDN

A permission is now named from the entry's RDN rather than from a slice of the
DN text (codelibs/fess#3292). A group whose CN carries a character the DN
escapes -- a comma, in practice -- therefore gets a different permission name
than it did in 15.7:

Group entry DN	up to 15.7	15.8
CN=Sales\, EMEA,CN=Users,...	2Sales	2Sales, EMEA
CN=Sales\, APAC,CN=Users,...	2Sales	2Sales, APAC

Two consequences worth an operator's attention, and the section states both:
groups that used to collapse onto one name no longer read each other's
documents, and documents indexed under the old name stop matching for
members of that group.

2. ldap.role.search.user.enabled now takes effect

Until 15.7 the permission named after the user was granted whatever this setting
said, so a deployment that turned it off has been running with the permission
granted anyway. After the upgrade its users lose the permission named after
themselves, and documents permissioned to an individual user stop matching for
that user. The section says to restore the shipped default of true to keep the
previous behaviour.

Verification

• Headings, underline lengths and list-table shapes checked in all seven files
  (three rows of three cells each, matching :header-rows: 1).
• Parsed each file with docutils before and after: no new messages in any
  language. The pre-existing ones are the |Fess| substitution and :doc:
  roles that docutils does not resolve on its own.