Ticket 47451 - add/enable/disable/remove plugins without server restart

Previous Design:  All plugins were only loaded at startup.  A global plugin list,
                  a shutdown list, and plugin DN hash are created.

New Design:       The lists/hash are now all protected by a r/w lock.  The read lock
                  is only used when calling plugin_call_func(), the write lock is used
                  for adding and removing plugins.  Since plugins can call plugins,
                  etc, the locking in the plugin_call_* functions is determined by
                  the use of local thread storage: is locked, or is not locked.
                  This mechanism prevents deadlocks.

                  Plugin updates(add, mod, delete) happen in the pre op stage of a
                  dse update, so that we can reject the update before the config is
                  updated, otherwise at the next server restart the server might
                  unexpectedly fail to start.

                  Plugins can now be added/enabled and deleted/disabled dynamically.
                  All plugin configuration (libpath, type, precedence, etc) is now
                  updated dynamically, unless that change breaks something.  Then it
                  is not dynamically applied, but it is still written to the dse.ldif.

                  A new internal reference counter has been added to plugin_call_func().
                  These are used to keep track of the active number of concurrent
                  operations being performed by the plugin.  This is used when disabling
                  a plugin or server shutdown - so that we do not free global locks and
                  config while there are still operations using them.  Since tasks do not
                  have access to the slapd plugin structure(for the plugin operation count),
                  they have their own ref counter where needed.  This task counter is
                  implemented when the task is created using slapi_plugin_task_new(),
                  instead of slapi_task_new(). Also, slapi_task_register_handler, needs
                  to be replaced with slapi_plugin_task_register_handler().

                  Plugins that register callbacks shouldi not use slapi_config_register_callback(),
                  and now use slapi_config_register_callback_plugin() - which takes
                  the pblock so the reference counters can be updated.

                  Plugins that create object extensions must also unregister those
                  extensions in the CLOSE function, as same goes for config callbacks.

                  This feature can also be turned on/off via "nsslapd-dynamic-pluings: on|off"

https://fedorahosted.org/389/ticket/47451

Jenkins: Passed.
Coverity: Passed.
Valgrind: Passed.

Reviewed by: rmeggins(Thanks!!)
Ticket #47748 - Simultaneous adding a user and binding as the user could fail in the password policy check

Bug description: In do_bind, bind_target_entry is retrieved from the
DB or the entry cache.  There was a small window that the entry failed
to retrieve from there but the bind procedure in the backend (be_bind)
succeeds.  In the case, NULL bind_target_entry is passed to the Pass-
word Policy check and it fails.

Fix description: If be_bind returns SUCCESS and bind_target_entry is
NULL, retrieve bind_target_entry agian, which is guaranteed since the
entry was retrieved in the backend and placed in the entry cache.

https://fedorahosted.org/389/ticket/47748

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)
Ticket 47740 - Fix coverity issues(part 7)

12496 - resource leak - ldap/servers/slapd/mapping_tree.c
12497 - resource leak - ldap/servers/slapd/mapping_tree.c
12500 - resource leak - ldap/servers/plugins/chainingdb/cb_instance.c
12501 - resource leak - ldap/servers/plugins/sync/sync_refresh.c
12506 - resource leak - ldap/servers/plugins/chainingdb/cb_config.c
12509 - reosurce leak - ldap/servers/plugins/chainingdb/cb_bind.c
12510 - reosurce leak - lib/ldaputil/certmap.c
12538 - resource leak - ldap/servers/plugins/mep/mep.c
12539 - resource leak - ldap/servers/plugins/posix-winsync/posix-winsync.c
12540 - resource leak - ldap/servers/plugins/posix-winsync/posix-winsync.c
12541 - resource leak - ldap/servers/plugins/posix-winsync/posix-winsync.c
12542 - resource leak - ldap/servers/plugins/posix-winsync/posix-winsync.c

https://fedorahosted.org/389/ticket/47740

Reviewed by: nhosoi(Thanks!)
Ticket 47756 - Improve import logging and abort processing

Description:  When importing a heavily nested LDIF file, the numsobordinates
              and ancestorID creation can take a very long time.  The current
              logging doesn't state that it started working on this areas, and
              it can appear that the import is hung, when in fact is it working.

              Also, there are a few places, when an error occurs(e.g. out of diskspace)
              where the the import will hang, and aborting the import doesn't work,
              and shutting the server down will also hang, and then it has to be killed.

              Added the missing "abort" checks in some loops, and also improved
              the import logging(progress stats, etc) for numbsubordinates and
              ancestorid creation.

https://fedorahosted.org/389/ticket/47756

Revewed by: nhosoi(Thanks!)
Ticket 47759 - Crash in replication when server is under write load

Bug Description:  When the server is under alot of load, a race condition allows
                  a replication connection LDAP struct to be freed(unbind) while
                  it is being used by another thread.  This leads to a crash.

Fix Description:  Extend the connection lock to also cover ldap client interaction
                  (e.g. conn->ld struct).

https://fedorahosted.org/389/ticket/47759

Reviewed by: nhosoi & rmeggins(Thanks!!)
Ticket 47655 - Improve replication total update logging

Description:  If an online initialization failed, the error message was vague and
              did not fully imply that it failed.

              Also, in repl5_tot_waitfor_async_results() we did not take into
              account if progress was being made, and our timeout was incorrectly
              set to 5 minutes, instead of 30 seconds.

https://fedorahosted.org/389/ticket/47655

Reviewed by: rmeggins(Thanks!)
Ticket 47667 - Allow nsDS5ReplicaBindDN to be a group DN

Bug Description:  The request is not to define a specific bind DN for a replica
			but to be able to specify a group and let all members
			be treated as replicaBindDN

Fix Description:   The fix adds a new attribute to the ndsdReplica object:
			nsDS5ReplicaBindDNGroup: <dn>
		   When this attr is set at startup or when the replica object is modified
			the group is expanded and its members and all mambers of its
			subgroups are added to a hash of replcabinddns. this is in
			parallel to the normal hash od replicabind dn specified using
			the existing attr nsDS5ReplicaBindDN.
		   Since groups can change, the list of bingdns based on groups has to be
			rebuilt when the spcified groups change. This check and the
			rebuilding of the group has a performance cost and will be done only
			in a specified interval, the interval can be configured by
			nsDS5ReplicaBindDNGroupCheckInterval.
			This attr takes the following values:
			-1 no dymanic check at runtime, admin must take care that groups are stable
				or restart to get changes accounted for
			0 everytime a binddn is verified the groupdns are rebuilt
			n only if n seconds have passed since last rebuild it is done again

https://fedorahosted.org/389/ticket/47667

Reviewed by: ?