Guard against ldap_sync_last_sync_at being nil

If ldap_sync_last_sync_at is nil, then the LDAP group got into an inconsistent state after the transition. Since it's possible for ldap_sync_last_sync_at to be nil, we guard against this occurrence and attempt to bubble up the error to the admin.

Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/1529