cn: ignore "does not exist" errors when deleting ACLs
cn: acl: expand 'shell' service
cn: use Net::LDAP::LDIF for raw dumps