Fix memberships: Dex SSO with tier gating across services

Update role submodules (dex, www, gitea, mastodon, matrix-stack,
peertube) and the membership app's LDAP/Dex settings in www.yaml.
In the root dex.yml, match groups by DN and use cn for names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dex.yml

@@ -42,9 +42,9 @@
     dex_ldap_user_base_dn: dc=eom,dc=dev
     dex_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
     dex_ldap_id_attribute: uid
-    dex_ldap_name_attribute: givenName
+    dex_ldap_name_attribute: cn
     dex_ldap_group_base_dn: dc=eom,dc=dev
-    dex_ldap_group_user_attribute: cn
+    dex_ldap_group_user_attribute: DN
     dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
 
     dex_matrix_client_enabled: true