Fix issue 3928: Wrong error message sent to access log (while correct one is in error log)

Allow access control handler implementations to throw DirectoryExceptions encountered when attempting to perform an access control decision. Previously, this was not possible and implementations were forced to deny the operation and log an error to the error log. The DSEE compat access control handler has been updated so that it now throws DirectoryExceptions when:

    * it fails to decode an access control related LDAP control (result code PROTOCOL_ERROR)

    * it fails to decode a modified ACI (result code INVALID_ATTRIBUTE_SYNTAX)

These errors will now be logged in the access log and returned to the client as expected.