The encoded public key is actually 65 bytes long, not 64.

This is shared code used by id/auth, id/keystore, and others. Unifying
it into its own package helps prevent drift among implementations.

Just use backoff.Retry() straight away without a wrapper.

Before, we weren't releasing the connection properly.

Simply by setting an empty bind DN.

Also simplifies handling of the connection pool itself, switching to
using deferred connects, and adds a test suite for misbehaving LDAP
servers to exercise failure modes.