Reset the bind identity when a connection is returned to the pool, and/or always establish the intended search identity in getConnectionWithOptions regardless of shouldBind().

In WrappedConnection's return-to-pool path, unbind (or mark the session as needing rebind) so no pooled connection ever carries an end-user identity into a later operation.

In getConnectionWithOptions, when shouldBind() is false but currentBoundUser() is set, force an anonymous rebind before returning the connection for a query, rather than skipping the rebind block entirely. The current guard conflates "no configured query user" with "connection is safe to reuse as-is."

Acceptance Criteria

• With LDAP authorization configured and no ldapQueryUser, a role lookup after an end-user PLAIN authentication executes under the anonymous bind, not the end-user's DN.
• Role sets computed for a user are independent of which other users recently authenticated.
• Deployments that do configure ldapQueryUser continue to rebind to the query user as before.

Test Coverage

• Unit/integration test: authenticate user A via PLAIN, then trigger a role lookup for user B; assert the search bind identity is anonymous (or the configured query user), never A's DN.
• Integration test with a mock LDAP server that returns different group memberships for anonymous vs an authenticated DN; assert the computed roles match the anonymous-bind result regardless of prior authentications.