s4-dsdb Reorganise and clarify the LSA objectClass check (forbidden on LDAP)