Add ldap_find_control()

macros for transaction groupings

'=' must be escaped (and escapable by '\') according to RFC2253 and draft-ietf-ldapbis-dn-XX (ITS#3009; must have slipped thru some changes long time ago...)

use "expand" instead of "regex" for group ACLs that allow substring expansion, preserving backwards compatibility; add sanity checks

Recognise tree delete control - needs backend support