cleanup objectclass inheritance; don't proceed if initial lookup resulted in a hit with "success" errcode and the base is search; either the filter doesn't match, or the same action is taken twice

with requested attribute lists empty or containing "*" are expanded
to contain "+" as well, so that all operational attributes are returned.
This may be required to work around dumb clients that interrogate
the rootDSE requesting "*" and expecting operational attributes to be
returned as well.  To make it a bit more generic, it can be configured
to do the same for an arbitrary search described by an URI.  For example,

overlay		allop
allop-URI	ldap:///??sub

before any database instantiation causes all searches to return "*","+"
when ors_attrs is NULL or countains "*".

need an AUXILIARY objectClass to play with some special error codes (need to update man page as well)...