s4:dsdb/samdb/ldb_modules/objectclass.c - move LSA specific object checks into "objec...

s4:dsdb/samdb/ldb_modules/objectclass.c - move LSA specific object checks into "objectclass_attrs" LDB module

LSA object classes are protected on both LDAP add and LDAP modify
operations, so I've refactored the previous check in the objectclass LDB
module only for LDAP adds in a new one in the objectclass_attrs LDB
module for both adds and modifies.
This is the result of the investigations done by Hongwei Sun and I in
the last months.
Interestingly these protection mechansim doesn't apply on LDAP deletes!

Signed-off-by: Andrew Bartlett <abartlet@samba.org>