I thought this was already happening, but it doesn't look like it.
Notes:
- gitlab-settings is already checked out on the current GitLab primary (gitlab2002 at this writing)
- Timer for sync-gitlab-group-with-ldap is defined in operations/puppet, should use the same pattern
- This may disrupt existing in-use instances of issues; do a dry run first