s4-dsdb: only enforce the extended dn rules over ldap