seems to fix the equivalent of ITS#4429 in back-meta; had to give up per-target conn-ttl and idle-timeout

add basic support for retry; protect internal bind behind mutexes; rework search, review candidate selection; minor cleanup.  Passes concurrency test036

   context checking and multiple match resolution via an internal search
b) move the candidate listing in a persistent per-thread buffer
c) fix bind procedure
d) minor cleanup

(a) and (b) should address ITS#2935; (b) and (c) should address ITS#3171

A test is also added

import selected improvements from back-ldap: use asynchronous Start TLS exop; allow propagating TLS if used in the original connection; minor cleanup