ldap: limit the retro changelog to dns subtree
    
    The content synchronization plugin can be limited to the dns subtree in
    Directory Server. This increases performance and helps to prevent some
    potential issues.
    
    Fixes: https://pagure.io/freeipa/issue/6515
    Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>