cli state-sync should become idempotent

[stolpeo]

When syncing twice in a row, there should be no changes. Currently, the actions to be performed on LDAP and FS are written into ldif files or bash scripts respectively. After the changes are manually applied, no changes should be left to be performed when running the sync another time (of course before a change occurred in the HPC access system by accepting requests. Note that users are created when they accept an invitation). It might be the case that it is already idempotent, but currently it is not possible to check for that.