LDAP connector: Support additionalSearchFilter for SunChangelogSyncStrategy

It is difficult to add support, as Sun changelog has a different structure, additionalSearchFilter cannot be applied directly on server side.

The entries need to be filtered one-by-one on client side, and there is no obvious suitable method for that in Directory API. In fact, maybe it even cannot be reliable on client side, as filter matching is schema-aware. Or maybe it can, but it is not easy.