Supports multiple algorithms:
* system crypt
* scrypt
* argon2

We just made up new $something$ prefixes for the new algorithms.

Modeled to follow the net/http ResponseWriter.

Also simplifies handling of the connection pool itself, switching to
using deferred connects, and adds a test suite for misbehaving LDAP
servers to exercise failure modes.

Now the default is for errors to be permanent, unless the error itself
has a Temporary() method that returns true (like the transient network
errors do in the net/ package).

Code 429 is used by the server-side throttling code.

Includes TLS authentication, to authorize peers
based on the subject of their X509 certificate.