improve fix to ITS#2923; note that suffix massaging is inherently flawed, because comperisons should always occur on Normalized DN, while massaging can also occur on Pretty DN, but there is no guarantee they have the same length or any length-based comparison can work; so in any case, we should pass the Normalized DN and, if the Pretty DN is present, massage it as well accordingly

and libtool's config already does the necessary detection.

should improve readability and (hopefully) decrease traffic on openldap-software; sorry I can't test it right now

unique value.

don't search if the filter is invalid; search also if an attribute is undefined for that objectclass, the filter may succeed anyway