Remove passed freshmen from the 10weeks ldap group after passing 10 weeks

[devinmatte]

There is now a 10weeks ldap group, to help show and determine who is currently in the 10 weeks process to services. Members should be removed from this upon passing a 10 weeks but remain in the intromembers group until they pass a spring evaluations

[mxmeinhold]

It would be nice to have conditional handle all the group updates, to prevent an RTP from having to do it, but with intro evals we run into an issue of information being exposed by house services before evals can distribute results. My thoughts on design for this (and for disabling failed accounts):

• When a result is selected in the slideshow, insert a row into the db (some new queue table or something) with the ldap changes to be effected, without actually making changes in ldap. Perhaps these should be abstract (e.g. 'fail-10weeks' rather than 'remove from 10weeks group') so that behavior can be changed in code without needing to update db fields.
• Have an evals only or similarly restricted page that displays these queued changes and allows evals to dispatch them one by one, so evals can wait to hit the button until after distributing results.

Also, I have some extra ldap info that should be updated after intro evals: In the event of a failed result, a user should be removed from every group other than current_student (e.g. [10weeks, intromembers, onfloor, active, member]) and the account should be disabled. I don't remember if disabling can be done via csh_ldap, or if we'll need to setup something else to talk to ipa.

[mxmeinhold]

This is related to #136