Previously, our `required_groups` check was indiscriminately unblocking
users whenever the condition was met. This was problematic because it
interfered with manually blocked users, as well as users blocked
because they were automatically set up.

Now we only unblock `ldap_blocked`, since those are the ones that could
have been blocked due to `required_groups`.

In the future we might introduce `saml_blocked` users for clarity, but
that might require a data migration.