fix(auth): canonical username from the entry; refuse empty passwords in both bind modes

- Request UserNameAttribute in the search (de-duplicated, case-insensitive) and return its
  first value as LdapAuthResult.Username, falling back to the typed name (I2).
- The empty-password guard now applies in ServiceAccount mode too: AD treats an empty-password
  simple bind as an unauthenticated bind and reports success (I3).
- Restore the dropped explanatory comments in CompleteWithServiceAccount / SearchUser.

ZB.MOM.WW.Auth/tests/ZB.MOM.WW.Auth.Ldap.Tests/FakeLdapConnection.cs

@@ -34,6 +34,9 @@ internal sealed class FakeLdapConnection : ILdapConnection
     /// </summary>
     public int BindAttempts { get; private set; }
 
+    /// <summary>The attribute list passed to the most recent <see cref="Search"/> call (the fake still returns every scripted attribute).</summary>
+    public IReadOnlyList<string>? SearchAttributes { get; private set; }
+
     /// <summary>Every call in order: <c>connect</c>, <c>bind:&lt;dn&gt;</c>, <c>search:&lt;filter&gt;</c>.</summary>
     public List<string> Calls { get; } = new();
 
@@ -41,9 +44,14 @@ internal sealed class FakeLdapConnection : ILdapConnection
 
     /// <summary>
     /// Scripts a user entry that will be returned by the next <see cref="Search"/> call.
-    /// Builds a minimal attribute bag with <c>memberOf</c> and optional <c>displayName</c>.
+    /// Builds a minimal attribute bag with <c>memberOf</c>, optional <c>displayName</c> and any
+    /// <paramref name="extraAttributes"/> (e.g. <c>sAMAccountName</c>) the test needs.
     /// </summary>
-    public FakeLdapConnection WithUserEntry(string dn, string[] memberOf, string? displayName = null)
+    public FakeLdapConnection WithUserEntry(
+        string dn,
+        string[] memberOf,
+        string? displayName = null,
+        IReadOnlyDictionary<string, string[]>? extraAttributes = null)
     {
         var attrs = new Dictionary<string, IReadOnlyList<string>>(StringComparer.OrdinalIgnoreCase)
         {
@@ -51,6 +59,11 @@ internal sealed class FakeLdapConnection : ILdapConnection
         };
         if (displayName is not null)
             attrs["displayName"] = new[] { displayName };
+        if (extraAttributes is not null)
+        {
+            foreach (var (name, values) in extraAttributes)
+                attrs[name] = values;
+        }
 
         _scriptedEntries.Add(new LdapSearchEntry(dn, attrs));
         return this;
@@ -177,6 +190,7 @@ internal sealed class FakeLdapConnection : ILdapConnection
         IReadOnlyList<string> attributes)
     {
         Calls.Add($"search:{filter}");
+        SearchAttributes = attributes;
         if (_throwOnSearch)
             throw new Novell.Directory.Ldap.LdapException(
                 "Search failed", Novell.Directory.Ldap.LdapException.Unavailable, searchBase);