slightly rework user/operational attributes handling (including fixing a bug in the logic of the previous change to backend_operational()); cleanup; more improvements to slapo-rwm and back-relay

clear shared connections when ldap_result fails with -1 (typically, remote server is down); fixes ITS#3217

clean up unnecessary checks; don't use SASL native authz if authz ID is not static, because back-ldap pools connections...

allow a hidden parameter to instruct the proxy that the SASL mech can do native authz; will disappear as soon as I can detect it automnatically