LDAP timestamp converter

Active Directory stores times as Windows FILETIME — 100-nanosecond intervals since 1601. This decodes `lastLogonTimestamp`, `pwdLastSet`, `accountExpires` and the rest.

The sentinel values matter more than the arithmetic here. A `pwdLastSet` of 0 means the user must change their password at next logon, not that it was set in 1601. An `accountExpires` of 0 or 9223372036854775807 both mean the account never expires — two different sentinels for the same meaning, which is a known inconsistency in the schema. And `lastLogonTimestamp` is deliberately imprecise: it is only replicated between domain controllers every 9 to 14 days by default, so a value that looks a fortnight stale usually is not evidence of anything. The precise attribute is `lastLogon`, which is not replicated at all and therefore differs per controller.