Ticket #47642 - Windows Sync group issues

Bug Description: When an entry is moved on AD, and the entry is
a member of a group, the value of the member in the group is
automatically updated.  But Windows Sync Control request only
returns the renamed entry; it does not return the group having
the member in it even though the value is updated.  This is
because an AD group stores DNT (Distinguish Name Tag -- ID in
integer) instead of the dn itself.  Since the rename operation
does not change DNT, the group entry on AD has no change, either.

On the DS side, the group entry stores the full DN which needs
to be adjusted to the renamed DN to complete the synchronization
with AD.

Fix Description: Once rename operation is received from AD,
windows_update_local_entry searches groups having a member value
matches the pre-renamed dn on DS, and replaces the old dn with the
renamed one.

Thanks to tbordaz@redhat.com for pointing out the possibility of
NULL dereference.  The problem is fixed, as well.

Thanks to rmeggins@redhat.com for suggesting to escape the search
filter value.  It was added.

https://fedorahosted.org/389/ticket/47642
(cherry picked from commit 98ddd817e26f236adebd80270ec71d7ec372c20e)
(cherry picked from commit 86515d1b18a96b9d7e6143f870b343030a7af5a7)
(cherry picked from commit ab4893cb851533d89e1b02c91972255a48776ce4)
Ticket #415 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist

Bug description:
2 case were fixed.
1) A group on AD has a member which is not a target of windows
   sync and exists only on AD.  The member value in the group is
   synchronized to DS.  If an operation is executed on AD so that
   the member is replaced with other members which are the target
   of the windows sync, the new member values are not synchronized.
2) If a group on AD and DS have members which are local and are
   not synchronized and the members are removed in the group on
   the other side, the delete operation is synchronized and
   deletes all the members including the local members.

Fix description:
1) In windows_generate_update_mods, even if a sync'ed member value
   in a DS entry is not the target of windows sync and it is does
   not exist on DS, a following modify operation including the member
   value is proceeded by confirming the existence on AD.
2) AD->DS: in windows_map_mods_for_replay
   DS->AD: in windwos_generate_update_mods
   added the code to check if an attribute is completely deleted on
   one side, then the each value on the other side is in the sync
   scope or not.  Put the value to the mod for the delete only if
   the value is in the sync scope.

Reviewed by Rich (Thank you!!)

https://fedorahosted.org/389/ticket/415
(cherry picked from commit 03814dd74df7f1f0d2842c5096c6425609da6f2c)
(cherry picked from commit 8772ea1ac524f1f011d51d0a42c0055f5641e2e6)