The AD plugin uses `AUTO` by default for its groupLookup.

however this has a performance hit and many users do not need this functionality.

Security should be enforced by `SecurityGroups`, thus we should default to only `tokenGroups` rather than auto (or auto should default to tokengroup lookup first - but that may break existing installations).

That way users will not get a slow experience of logging in and authentication lookup that often plagues jenkins with AD setups by default (they will have to opt into it!)