Add a note about LDAP nested group resolution [ci skip]

For LDAP sync, nested groups must fall within the configured
`group_base`. A customer recently ran in to this issue. It's
not immediately obvious but at least we can make a note in the
documentation.

doc/administration/auth/ldap-ee.md

@@ -143,6 +143,12 @@ Other LDAP servers should work, too.
 Active Directory also supports nested groups. Group sync will recursively
 resolve membership if `active_directory: true` is set in the configuration file.
 
+> **Note:** Nested group membership will only be resolved if the nested group
+  also falls within the configured `group_base`. For example, if GitLab sees a
+  nested group with DN `cn=nested_group,ou=special_groups,dc=example,dc=com` but
+  the configured `group_base` is `ou=groups,dc=example,dc=com`, `cn=nested_group`
+  will be ignored.
+
 ### Queries
 
 - Each LDAP group is queried a maximum of one time with base `group_base` and