✨ Commits existing images to git

- Implemented sync-roles.sh to synchronize Active Directory group memberships as MariaDB roles and user accounts.
- Created Containerfile for building a custom ldap2pg image with patched YAML decoding.
- Added provision-user-db.sh for provisioning user databases and roles based on LDAP synchronization.
- Introduced a new Containerfile for MariaDB with PAM authentication via pam_ldap.
- Configured PAM service for MariaDB logins and added necessary plugins for LDAP authentication.
- Implemented health checks and entrypoint scripts for MariaDB and pgpool containers.
- Enhanced PostgreSQL image with additional extensions and custom pg_hba.conf for improved security and functionality.

database/postgres/pg_hba.conf

@@ -0,0 +1,24 @@
+# Authoritative pg_hba.conf for this image.
+#
+# Activated via the hba_file GUC (see conf.d/20-hba.conf), so it fully replaces
+# the initdb-generated $PGDATA/pg_hba.conf. This also means the docker-entrypoint's
+# appended "host all all all ${POSTGRES_HOST_AUTH_METHOD}" line (written to the
+# PGDATA copy) is never consulted -- ordering here is authoritative.
+#
+# pg_hba.conf is FIRST-MATCH-WINS, so the tiers are ordered deliberately:
+#   1. local/loopback allows  (first: nothing can lock out local admin)
+#   2. site rules             (include_dir /etc/postgresql/hba.d: mount files here)
+#   3. default-deny           (last: fail closed)
+#
+# TYPE     DATABASE  USER  ADDRESS         METHOD
+
+# 1. Local socket + loopback
+# local      all       all                   trust
+host       all       all   127.0.0.1/32    scram-sha-256
+host       all       all   ::1/128         scram-sha-256
+
+# 2. Site-specific rules (user-provided; mount *.conf files into this dir)
+include_dir "/etc/postgresql/hba.d"
+
+# 3. Default-deny catch-all
+host       all       all   all             reject