ITS#4556 ACLs for new entries

[Howard Chu <hyc@symas.com>]

Revisiting this topic - DITStructureRules are not a solution to this problem. 
E.g. in cn=config, now that you can grant write access to arbitrary users, it 
becomes pretty critical to be able to prevent certain users from creating 
certain types of objects. E.g., I may want to allow someone to be able to 
create one type of child object under cn=config (e.g., databases) but not some 
other type (e.g., modules). So at the very least we need to be able to use ACL 
filters on new entries.
--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP     http://www.openldap.org/project/