Bug 329751 - "nested" filtered roles searches candidates more
    than needed
    
    https://bugzilla.redhat.com/show_bug.cgi?id=329751
    
    Bug Description: If nsRoleFilter in nsRoleDefinition contains
    virtual attributes in the filter AND the attribute type is
    not indexed, following searches could go in to a loop starting
    from slapi_vattr_filter_test.  On the other hand, if the
    the attribute type is indexed, the nsRoleDefinition is ignored.
    The server does not support virtual attributes for nsRoleFilter,
    but it was not checked.  This patch tries to detect such an invalid
    role definition and issues an error.  Note: the check cannot detect
    the case nsRoleFilter is already in the db, then add CoS defining
    an attribute in the nsRoleFilter as an virtual attribute.