This fixes a failure analogous to that of '(cn=)' filter for modrdn
and so. What happens is that LDAP_rewrite calls the *normalize
function for the attribute description in each AVA; on turn, the
*normalize function expects to operate on a validated value. IMHO,
each *normalize function should also do validation (at least, complain
about values that wouldn't pass the appropriate *validate function),
otherwise we need to do a validation prior to any normalization.
If this behavior is preferable, then we need to change at least the DN
normalization functions, but I suspect every normalization function
as well.