migrating from shadowAccount to password policy overlays

[Jonathon Anderson <jonathon.anderson@kaust.edu.sa>]

We are in the midst of migrating from `shadowAccount` objects to the
password policy overlay.  Everything seems to be working so far, but I
have been unable to migrate the data from `shadowLastChange` to
`pwdChangedTime`.  In particular, once I have the desired value for
`pwdChangedTime`, I don't know how to write it into the attribute.

ldap_modify: Constraint violation (19)
	additional info: pwdChangedTime: no user modification allowed

I read something about "relax rules" and oid
`1.3.6.1.4.1.4203.666.5.12`, but I haven't figured out how to use it.

How do I execute an `ldapmodify` that writes into `pwdChangedTime`?

~jonathon