Revert "Ticket #47431 - Duplicate values for the attribute nsslapd-pluginarg are not handled correctly"

This reverts commit d2c5b35e20578043117f84e928d96d296bdfc046.

This commit caused a regression by introducing a hard-coded limit to
the number of plug-in arguments for some plug-ins.  This needs to be
solved in a different way that doesn't limit the number of arguments.
Ticket 208 - [RFE] Roles with explicit scoping in RHDS

Bug Description:
	A limitation of the application using the role mechanism is that the scope of a role
	is the subtree where the role is defined.
	That means the role definitions are often mixed with the entries they are dealing with.
	Usually configuration info are seperated from the data. This RFE aims to separate the
	role definitions from the DIT subtree where are stored the entries

Fix Description:
	This RFE introduces a new configuration attribute 'nsRoleScopeDN' in the role definition.
	This attribute specifies the subtree where the role apply.
	See http://directory.fedoraproject.org/wiki/Creation_of_an_explicit_scoping_for_the_roles_%28ticket_208%29

https://fedorahosted.org/389/ticket/208

Reviewed by: Noriko Hosoi (thanks Noriko !)

Platforms tested: Fedora 17

Flag Day: no

Doc impact: yes

	A role definition (entry with Objectclass=nsRoleDefinition), may contain an optional single valued attribute
	'nsRoleScopeDN'.
	In that case, the role does not apply to the subtree where it is defined but to the subtree referred by 'nsRoleScopeDN'.
	'nsRoleScopeDN' is a DN syntax attribute. To be taken into account, its value must be a subtree under the suffix
	where the role is defined.
	If not present or with invalid value, the role will apply to the subtree where it is defined.
Ticket #48 - Active Directory has certain uids which are reserved and will cause a Directory Server replica initialization of an AD server to abort.

Bug description: Some account names (e.g. "service") is reserved
in Active Directory.  If DS has an entry having such an NT user ID
and the entry is synchronized to the AD, it fails with LDAP_ALREADY_
EXISTS, but the error is gracefully ignored.  In the total update,
updating Account Control bit follows the failed add, which fails
since the AD entry WinSync expects does not exist and it aborts
the total update.

Fix description: If adding a DS entry to AD fails and the updating
Account Control bit also fails, the following note is logged in
the error log and the total update continues:
  windows_process_total_add: Creating AD entry "cn=service service,
  cn=Users,dc=EXAMPLE,dc=COM" from DS entry "uid=service,ou=People,
  dc=example,dc=com" failed. AD reserves the account name. Ignoring
  the error...

In addition, in windows_parse_config_entry, f the attribute values
in the agreement is retrieved before the agreement is started, the
following error is logged, which is not necessary.  This patch
stops logging it if the agreement does not set "protocol" yet.
  Replication agreement for agmt="cn=WinSync" could not be updated.
  For replication to take place, please enable the suffix and restart
  the server.

Reviewed by Rich (Thank you!!)

https://fedorahosted.org/389/ticket/48
Ticket #609 - nsDS5BeginReplicaRefresh attribute accepts any value and it doesn't throw any error when server restarts.

Bug description: If an invalid value is set to ds5BeginReplicaRefresh
in an agreement, it does not affect the behaviour, but it does not get
purged from the agreement and causes an error if "ds5BeginReplicaRefresh:
start" is added.

Fix description: Adding an invalid ds5BeginReplicaRefresh is rejected
with "DSA is unwilling to perform" and the following error is returned:
    ldap_modify: additional info: Invalid value (junk_value123) value
	supplied for attr (nsds5BeginReplicaRefresh); Ignoring ...

Reviewed by Rich (Thank you!!)

https://fedorahosted.org/389/ticket/609