Fix typo
Support blanking the member attribute

This allows remapping the member attribute to an empty string which
removes support for that attribute. This can reduce the number of search
operations if the attribute is not used.
Use do_try_search() also for paged searches

This also changes do_try_search() to support building continued paged
controls and lays the groundwork for adding more search controls.
Ignore missing page controls

Since we could get arbitrray controls and are only interested in page
controls we ignore failures to find page controls.
Rename entry property to indicate storage type

This changes entrye->rangedattributevalues to entry->buffers because the
propery is not only used for ranged attribute values but for anything
that can be freed with free().
Request attribute deref via search control

This uses the LDAP_CONTROL_X_DEREF control as descibed in
draft-masarati-ldap-deref-00 to request the LDAP server to dereference
member attribute values to uid attribute values in order to avoid doing
extra searches.

This control is currently only added for group search by looking for the
member attribute in the search.
Provide replacement ldap_create_deref_control()

This adds a test for a bug in OpenLDAP that allocated a
LDAP_CONTROL_PAGEDRESULTS control instead of a LDAP_CONTROL_X_DEREF
control.
Skip member attributes in bymember search

This changes the group by member searches to not request the member
attributes. This will speed up result parsing by a fraction because less
data is transferred but will also cause the deref control not to be
added to these searches.
Provide a myldap_get_deref_values() function

This function looks for deref response controls (LDAP_CONTROL_X_DEREF)
in the entry and returns the information from the dereferenced attribute
in two lists: dereferenced values and attribute values that could not be
dereferenced.
Use myldap_get_deref_values() to get member uids

This uses information from the deref control (if available) to get the
username for each of the members of the group. Any missing deref member
attribute values will be seen as nested groups and will be traversed if
nested group support is enabled.
Update documentation

This documents the way the deref controls are used.
Implement deref control handling

This uses the LDAP_CONTROL_X_DEREF control as described in
draft-masarati-ldap-deref-00 to request the LDAP server to dereference
group member attribute values to uid attribute values.

This should reduce the number of searches that are required for
expanding group members that use the member attribute.

This mechanism could also be used to extract information on nested
groups but the gains are less clear there.

Not all LDAP servers support this control. In OpenLDAP, load the
(currently undocumented) deref overlay and enable it for the database to
take advantage of this improvement.

There is a functional difference when using this control. Any returned
deferred uid value returned by the LDAP server is accepted as a member.
No checks are performed to see if the user matches the search base and
search filters set for passwd entries.