Run the LDAP connector tests against an embedded OpenDJ

[vharseko]

What

The LDAP connector's tests never ran: surefire had skip=true since the
ForgeRock era, and LdapConnectorTestBase expected a pre-built OpenDS
instance on the test classpath that is no longer in the repository. This
sets the instance up at run time from the OpenDJ distribution archive, so
159 tests now run (up from none) and mvn verify on the module is green.

No product code is changed — only tests, test resources, and pom wiring.

How the embedded instance is built

LdapConnectorTestBase now, once per JVM:

1. Extracts and sets up an empty OpenDJ from the opendj-server-legacy:slim
   distribution archive (a new test-scoped dependency), on run-time-picked
   free ports so a directory server already on 2389/2636 does not clash.
2. Applies test-config.ldif (password policies, a VLV index, replication
   for the external change log, the ACIs the tests need) before importing,
   so entries are accepted and indexes populated.
3. Imports data.ldif plus 2000 Big Company accounts generated by MakeLDIF
   from bigcompany.template.
4. Keeps a pristine copy of the mutable directories and restores it for each
   test that asks for a server restart — building the instance once is far
   too slow to repeat per test.

SunDSTestBase now drives the same embedded OpenDJ instead of an external
Sun DSEE, so the change-log sync and VLV tests run too.

Dependency note

This bumps opendj.version to 5.1.2-SNAPSHOT, which carries the fix for
OpenDJ #737
(cn=changelog searches failing when aliases are dereferenced — the sync
tests read the change log over JNDI, which dereferences aliases by default).
The version goes through a single opendj.version property; it should be
moved to the released 5.1.2 once that is out.

Stale expectations fixed along the way

The tests had drifted during the years they were skipped:

• server type is OpenDJ, not OpenDS / Sun DSEE
• useBlocks defaults to false, so searches past the size limit must ask
  for blocks
• add → CREATE, modify/modrdn → UPDATE since the ICF 1.4 upgrade
• an add is attributed to creatorsName, not modifiersName
• sync() returns its token through a SyncTokenResultsHandler
• __SERVER_INFO__ is a synthetic object class with no attributes
• OpenDJ computes VLV offsets exactly, so the Sun DSEE overlap workaround
  can't be exercised — that test now just checks VLV paging returns every
  entry
• testSyncNotSupported becomes testSyncSupported: OpenDJ serves the
  change log, so the connector reports sync as supported, now proven
  end to end by the change-log sync tests

Also fixes BlindTrustManager.getAcceptedIssuers() returning null, which
aborts the TLS handshake once the provider is installed JVM-wide, and drops
a reference to a non-existent testng.xml suite file.

Test

mvn verify -pl OpenICF-ldap-connector → 159 run, 0 failures, 0 skipped.