connector: improve error message for callback URL mismatch

Documentation/ldap-connector.md: Warn about LDAP connector's bindPW restriction.

server: fix localhost redirect validation for public clients

connector/ldap: correct a comment.

connector/ldap: check for blank passwords and return error.

cmd/dex/serve: add local connector directly to static connectors in storage

server/api: return empty list of refresh tokens if user does not have any

server: account for dynamically changing connector object in storage.

README.md: reorganize README

* Highlights that dex is NOT a user-management system.
* Highlights ID Tokens as dex's primary feature.
* General cleanup.

Update kubernetes.md

fixed typo

Documentation: add a doc describing how to use dex

*: update maintainers

Dex on Kubernetes with RBAC authorization - documentation updated

connector/saml/testdata: fix bad status test case

README: add section about reporting security vulnerabilities

It was pointed out by @davidillsley that we don't point this out
anywhere in our docs.

Fix two typos

Signed-off-by: zhuguihua <zhuguihua@cmss.chinamobile.com>

Change storace to storage in cmd/dex/config.go,
change userSearch to groupSearch in connector/ldap/ldap.go

*: update grpc and correct protobuf generation

Turns out that manually setting PATH in the Makefile doesn't work
so we've been using the protobuf plugins installed on the host. Fix
this by specifying plugins by path.

Updated documentation for dex on k8s when RBAC authorization is used

connector/ldap: support the StartTLS flow for secure connections

When connecting to an LDAP server, there are three ways to connect:

1. Insecurely through port 389 (LDAP).
2. Securely through port 696 (LDAPS).
3. Insecurely through port 389 then negotiate TLS (StartTLS).

This PR adds support for the 3rd flow, letting dex connect to the
standard LDAP port then negotiating TLS through the LDAP protocol
itself.

See a writeup here:

http://www.openldap.org/faq/data/cache/185.html

Notice this when inspecting the code coverage results. For some
reason this test wasn't triggering the bad status code path, maybe
due to signature validation. Removing the comment fixed the code
coverage.