s4:dsdb/acl: don't protect confidential attributes when "acl:search = yes" is set