s4:samldb LDB module - fix the behaviour when changing the "userAccountControl"

s4:samldb LDB module - fix the behaviour when changing the "userAccountControl"

Ekacnet was not quite right yet but his patch made me think further.
This primary group changing is only needed if the account type changes.
With this patch we do one more search if the "userAccountControl"
changes but we save us from doing these unneeded and wrong modify replace
operations most of the time.

Reviewed-by: abartlet