- move broadest search condition to the end of search filter

Stupid samba4 LDAP resolves searches by the order of conditions in
search filter. This causes very slow response times when search filter
contains broad condition at the begining. Moving those to the end of the
filter greatly improves performance with such servers and doesn't impact
queries to other servers.