Bug 588791 - Allow anonymous rootDSE access only
    
    This patch changes the nsslapd-allow-anonymous-access config
    setting to allow a third value that gives anonymous access to
    search the rootDSE.  If you set this attribute to "rootdse", an
    anonymous bind identity is only allowed to do a rootDSE search
    or prove that it is someone other than anonymous.  This also
    required allowing explicit anonymous BIND operations through since
    ldapsearch performs an explicit bind before searching.  The old
    behavior with the "on" and "off" settings remains unchanged.