Support password last change attributes

Need to support shadowLastChange LDAP attributes and friends, that allow us to track the time of the last password change for every user. This needs to be handled in the database and surfaced to the API on the User object.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information