- Introduce the "userAccountControl", "groupType" and "sAMAccountType" flags
- Corrects the "domain/forestFunctionality" and "domainControllerFunctionality" flags

This reverts commit fdd62e9699b181a140292689fcd88a559bc26211.

abartlet and I agreed that this isn't the right way to enforce the password
policies. Sooner or later we've to control them anyway on the directory level.

The "setpassword" script should use the "samdb_set_password" call to change
the NT user password. Windows Server tests show that "userPassword" is not the
right place to save the NT password and does not inherit the password complexity.

This allows us to test out the code that will do the modify of the
prefixMap, and to provide the bindings that may assist a future
upgrade script.

Andrew Bartlett

Needed for special characters (e.g. in German "Umlaute")

This helps ensure we don't load the schema too often in the provision
(allowing a reference in of the schema before the modules load).

Andrew Bartlett

This allows us to load the schema against one ldb context, but apply
it to another.  This will be useful in the provision script, as we
need the schema before we start the LDAP server backend.

Adnrew Bartlett

Tests for the right behaviour of this introduced constructed attribute.
Since we don't support the read-only-ness of those attributes yet, I commented
some lines out.
Also I had to add a function for python which converts domain SIDs in RIDs.
And a small fix for the "groupType" test.