add support for allowedChildClasses, allowedChildClassesEffective: the former basically consists of all structural objectClasses, the latter is identical if the user can write 'children', absent otherwise

Lookup user DN in pam_authz if it was not provided
Fix compare checking in pam_authz

Fix: use attr_valfind, not value_find_ex
Fix usage flags for normalizing
Fix pam_authz result code

OpenLDAP Software (though they may not necessarily be supported by the
OpenLDAP Project).