Limit memberOf and refInt DS plugins to main IPA suffix.

This drastically improves performance of retro changelog trimming.

https://fedorahosted.org/freeipa/ticket/3967
Remove working directory for bind-dyndb-ldap plugin.

The working directory will be provided directly
by bind-dyndb-ldap package.

This partially reverts commit 689382dc833e687d30349b10a8fd7dc740d54d08.

https://fedorahosted.org/freeipa/ticket/3967