Description of problem:
When renaming a subtree that contains group and user entries such as the users
are members of the groups, referential integrity plugin operation fails.

From Noriko's email:

I'm afraid this particular test case may not work with referential integrity
with the betxn timing.

This case renames ou=A,dc=suffix to ou=X,ou=Y,ou=Z,dc=suffix. And we have
users and groups in ou=A,dc=suffix with having the users as a member in the
groups. Please note that users are located prior to the groups.

If we rename ou=A,dc=suffix to ou=X,ou=Y,ou=Z,dc=suffix, its children are
renamed and it triggers the referential integrity plug-in (Let's say
uid=testuser). In the reverential integrity plug-in, it searches entries which
have the DN (uid=testuser,ou=A,dc=suffix) and it tries to replace it with a new
DN (uid=testuser,ou=X,ou=Y,ou=Z,dc=suffix). But the found group entry's DN is
still an old one (cn=testgroup,ou=A,dc=suffix). And modifying the entry is
failing in the test case due to no such entry (LDAP_NO_SUCH_OBJECT).

Version-Release number of selected component (if applicable):
389-ds-base-1.3.1.6-24

How reproducible:
always

Steps to Reproduce:
1. Create a (large) number of entries as groups and members of these groups.
2. Rename the subtree as in description