fix extendedMatch and approx hfilter andling; get rid of subtree_cond (argh, need to trim it from config and docs ...)

added referral support to back-{ldap,meta}; need to allow send_serch_reference() handle NULL entry pointer

let caller log it if they care.

Ignore DB_KEYEXIST and DB_NOTFOUND errors in key_change.

first time after all. see read(2) and write(2)...)

Make sure client controls are not specified multiple times.
NT port updates.

Update NT build.

common controls across all tools.

the backend attempts a ldap_unbind() that results in calling
ldap_pvt_sasl_mutex_lock() with a NULL argument, causing a SIGSEGV.
I added a few assert() to catch this (I wonder if this might
be related to ITS#1982 "kill -INT corrupts database").